15181 matches found
Simple Online Hotel Reservation System - Cross-Site Request Forgery (Add Admin)
Simple Online Hotel Reservation System - Cross-Site Request Forgery Add Admin Exploit Title: Simple Online Hotel Reservation System - Cross-Site Request Forgery Add Admin Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 25, 2019 Vendor Homepage:...
Logic Flaw Vulnerability in Cloud Premium CMS
YUNUCMS YUNUCMS is a professional marketing enterprise building system based on PHP + MYSQL as the core development. YUNUCMS has a logic flaw vulnerability, which can be exploited by attackers to overstep their rights and add administrator accounts...
elFinder Command Injection v<2.1.48
elFinder is an open-source file manager available as a web application. A command injection vulnerability in the image handling functionality exists for versions prior to 2.1.48. This exploit requires that the exiftran utility be installed. Recent assessments: space-r7 at May 09, 2019 5:57pm UTC...
D-Link DIR-825 Information Disclosure Vulnerability
D-Link DIR-825 devices are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Latest Drupal RCE Flaw Used by Cryptocurrency Miners and Other Attackers
Another remote code execution vulnerability has been revealed in Drupal, the popular open-source Web content management system. One exploit — still working at time of this writing — has been used in dozens of unsuccessful attacks against our customers, with an unknown number of attacks, some like...
Joomla JM Car Classifieds CarAgent Templates 3.8.12 SQL Injection
Exploit Title : Joomla JM Car Classifieds CarAgent Templates 3.8.12 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 25/02/2019 Vendor Homepage : joomla-monster.com Software Information Link :...
CVE-2019-9078
ZZCMS 2019 contains a cross-site scripting (XSS) vulnerability in the inc/stopsqlin.php route, exploitable via the arbitrary user parameter ask.php?do=modify where mixed-case strings like sCrIpT are not blocked. This is documented across multiple sources (CNVD/CNVD-2019-05298 and CVE-2019-9078) w...
CVE-2019-9063
PHP Scripts Mall Auction website script 2.0.4 allows parameter tampering of the payment amount...
PHP Security Check List
PHP: Hypertext Preprocessor is a web-based, server-side, multi-use, general-purpose, scripting and programming language that can be embedded in HTML. The PHP development, which was first created by Rasmus Lerdorf in 1995, is now being run by the PHP community. The PHP programming language is stil...
Qualys Cloud Platform 2.37 New Features
This release of the Qualys Cloud Platform version 2.37 includes updates and new features for Security Assessment Questionnaire and Web Application Scanning, highlights as follows. Security Assessment Questionnaire Manager access to all active campaigns – Questionnaire Manager role now has access ...
C4G Basic Laboratory Information System (BLIS) 3.4 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: C4G Basic Laboratory Information System BLIS 3.4 - Multiples SQL Injection Software Links/Project: https://github.com/C4G/BLIS | http://blis.cc.gatech.edu/index.php Version: C4G Basic Laboratory Information System v3.4 Exploit...
Micro Focus Filr Path Traversal Vulnerability
Micro Focus Filr is a file access and sharing solution for businesses. A path traversal vulnerability exists in the web application component of Micro Focus Filr prior to version 3.0 Security Update 6. An attacker could exploit this vulnerability to download arbitrary files from the Filr server...
CVE-2019-3474
A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior to Security Update 6...
CVE-2019-3474
A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior to Security Update 6...
Path traversal
A path traversal vulnerability in the web application component of Micro Focus Filr 3.x allows a remote attacker authenticated as a low privilege user to download arbitrary files from the Filr server. This vulnerability affects all versions of Filr 3.x prior to Security Update 6...
CVE-2019-3474
CVE-2019-3474 describes a path traversal vulnerability in the web application component of Micro Focus Filr 3.x. An attacker authenticated as a low-privilege user can download arbitrary files from the Filr server. The issue affects all Filr 3.x versions prior to Security Update 6. Public exploit ...
Smule: Error Page Content Spoofing or Text Injection
Description: -------------- Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, a...
First look at Tenable.io Web Application Scanner (WAS)
When Tenable firstly announced Web Application Security scanner as a part of their new Tenable.io platform, it was quite intriguing. Certainly, they already had some WAS functionality before in Nessus. For example, path traversal check was pretty good. But this functionality was quite fragmental...
SQL injection vulnerability in the front-end bi***_mo***.asp file of the EcoTimes Enterprise Online Bookkeeping Management System
EcoTimes Enterprise Online Bookkeeping Management System" is an online bookkeeping software, especially suitable for small and medium-sized enterprises, stores, etc. to manage cash flow accounts, accounts receivable and payable accounts, as well as the company's bookkeeping and other related...