Online Catering Reservation System 1.0 - Remote Code Execution (Unauthenticated)

Exploit Title: Online Catering Reservation System 1.0 - Unauthenticated Remote Code Execution Date: 28-02-2021 Exploit Author: Christian Vierschilling Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/11355/online-catering-reservation.html Version:...

Covid-19 Contact Tracing System 1.0 - Remote Code Execution Exploit

Exploit Title: Covid-19 Contact Tracing System 1.0 - Remote Code Execution Unauthenticated Exploit Author: Christian Vierschilling Vendor Homepage: https://www.sourcecodester.com Software Link:...

Online Catering Reservation System 1.0 Code Execution

Exploit Title: Online Catering Reservation System 1.0 - Unauthenticated Remote Code Execution Date: 28-02-2021 Exploit Author: Christian Vierschilling Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/11355/online-catering-reservation.html Version:...

Covid-19 Contact Tracing System 1.0 Code Execution

Exploit Title: Covid-19 Contact Tracing System 1.0 - Remote Code Execution Unauthenticated Date: 28-02-2021 Exploit Author: Christian Vierschilling Vendor Homepage: https://www.sourcecodester.com Software Link:...

Weak password vulnerability in Tianqing web application security gateway (CNVD-2021-16888)

Tianqing Web Application Security Gateway is a new-generation Web Application Firewall WAF and application delivery network security product developed by Qisda. Tianqing Web Application Security Gateway has a weak password vulnerability, which can be exploited by attackers to obtain sensitive...

PayloadsAllTheThings

This repository is an offensive tool for Web Application Security and Pentest/CTF. It contains a list of useful payloads and bypass for various web application security vulnerabilities. The repository includes tools and exploits for vulnerabilities such as CRLF injection, CSRF injection, and CORS...

Doctor Appointment System 1.0 Cross Site Scripting Vulnerability

Exploit Title: Doctor Appointment System 1.0 - Reflected POST based Cross Site Scripting XSS in comment parameter CVE: CVE-2021-27317 Exploit Author: Soham Bakore Vendor Homepage: https://www.sourcecodester.com/php/14182/doctor-appointment-system.html Software Link:...

Six Apart Movable Type Cross-Site Scripting Vulnerability (CNVD-2022-22654)

Six Apart Movable Type is an application of Six Apart, Inc. Six Apart Movable Type has a cross-site scripting vulnerability in several of its products, which stems from the lack of proper validation of client data in the WEB application and can be exploited to inject arbitrary scripts via...

Doctor Appointment System 1.0 Cross Site Scripting

Exploit Title: Doctor Appointment System 1.0 - Reflected POST based Cross Site Scripting XSS in comment parameter Date: 26-02-2021 CVE: CVE-2021-27317 Exploit Author: Soham Bakore Vendor Homepage: https://www.sourcecodester.com/php/14182/doctor-appointment-system.html Software Link:...

Anatomy of a Security Super Bowl Dynasty, Part 1: The Defense

Imperva’s Directors of Technology in the Office of the CTO, Brian Anderson and Craig Burlingame, recently conducted an informal education session titled Creating a Security Super Bowl Dynasty. In this presentation, they used examples of how teams create consistent, sustainable success in American...

IBM FileNet Content Manager 跨站请求伪造漏洞

IBM FileNet Content Manager is a content management solution for the FileNet P8 platform from IBM USA. The solution combines document management with ready-to-use workflow tools to manage images, video, Web content, compliance documents, and more. IBM FileNet Content Manager suffers from a...

WordPress NextGEN Gallery plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. all-in-one-wp-security-and-firewall is a website security plugin used in it. nextGEN Gallery is an image gallery plugin used...

Six Apart Movable Type 跨站脚本漏洞

Six Apart Movable Type is an application of Six Apart, Inc. Six Apart Movable Type has a cross-site scripting vulnerability in several of its products, which stems from the lack of proper validation of client data in the WEB application and can be exploited to inject arbitrary scripts via...

Six Apart Movable Type 跨站脚本漏洞

Six Apart Movable Type is an application of Six Apart, Inc. Six Apart Movable Type has a cross-site scripting vulnerability in several of its products, which stems from the lack of proper validation of client data in the WEB application and can be exploited to inject arbitrary scripts via...

Apache MyFaces Cross-Site Request Forgery Vulnerability

Apache MyFaces Trinidad is a U.S. Apache Apache Foundation contains a large number of enterprise-class component libraries and support for attachment JSF framework. A cross-site request forgery vulnerability exists in Apache MyFaces. The vulnerability stems from a lack of proper validation of...

CVE-2021-3339

ModernFlow prior to 1.3.00.208 has an access control weakness where web-page access is not constrained to members of a security group. The issue is demonstrated on the Search Screen and the Profile Screen. Several external entries (Red Hat, PRION, NVD, CVE) confirm the same description; no public...

Securing Your Web App, One Robot at a Time

Modern web apps are two things: complex, and under persistent attack. Any publicly accessible web application can receive up to tens of thousands of attacks a month. While that sounds like a reason to immediately pull the plug and find a safe space to hide, these are likely spread across the...

Apache MyFaces Trinidad 跨站请求伪造漏洞

Apache MyFaces Trinidad is a U.S. Apache Apache Foundation contains a large number of enterprise-class component libraries and support for attachment JSF framework. A cross-site request forgery vulnerability exists in Apache MyFaces. The vulnerability stems from a lack of proper validation of...

Security Bulletin: IBM Maximo Data Loader (maxloader) shipped with IBM Maximo for Civil Infrastructure is vulnerable to cross-site scripting and missing or insecure "X-XSS-Protection" header

Summary There is missing or insecure "X-XSS-Protection" header in Maximo Data Loader maxloader which is shipped with IBM Maximo for Civil Infrastructure. It may be possible to gather sensitive information about the web application. Vulnerability Details CVEID: CVE-2021-20446 DESCRIPTION: IBM Maxi...

Pi-hole Web Interface < 5.4 Multiple Vulnerabilities

The Pi-hole Web Interface previously AdminLTE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...