NUUO NVRmini upgrade_handle.php Remote Command Execution

This exploits a vulnerability in the web application of NUUO NVRmini IP camera, which can be done by triggering the writeuploaddir command in the upgradehandle.php file. Module Options msf use exploit/multi/http/nuuo/nvrminiupgraderce msf undefinednvrminiupgraderce show actions ...actions... msf...

U.S. Dept Of Defense: SOAP WSDL Parser SQL Code Execution

Summary: SOAP WSDL Parser SQL Code Execution Description: It was possible to parse WSDL resources and read all functions from the SOAP Admin Panel, therefor i was able to repeat the sql query with a tampered request with my own custom SQL command. i was able to extract all the database names for...

CVE-2018-14924

Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" aka user fullname field...

CVE-2018-14929

Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp aka home page url parameter...

Entrepreneur Job Portal Script 3.0.1 - Cross-Site Scripting

Entrepreneur Job Portal Script 3.0.1 - Cross-Site Scripting. CVE-2018-14082. Webapps exploit for PHP platform Exploit Title: Entrepreneur Job Portal Script 3.0.1- has Stored XSS via Search bar and Location Date: 14.07.2018 Site Titel : JOB SITE Job Portal Vendor Homepage:...

Basic B2B Script 2.0.0 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: PHP Scripts Mall Basic B2B Script 2.0.0 has Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields. Site Titel : B2B Script Vendor Homepage: https://www.phpscriptsmall.com/ Vendor Software :...

PHP Template Store Script 3.0.6 - Cross-Site Scripting

Exploit Title: PHP Template Store Script- 3.0.6 - Stored XSS via Addres ,Bank Name,and A/c Holder Name Date: 02.08.2018 Site Titel : Exclusive Scripts Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: http://www.exclusivescript.com/ Category: Web Application Version: 3.0.6 Exploit...

Entrepreneur Job Portal Script 3.0.1 Cross Site Scripting

Exploit Title: Entrepreneur Job Portal Script 3.0.1- has Stored XSS via Search bar and Location Date: 14.07.2018 Site Titel : JOB SITE Job Portal Vendor Homepage: https://www.phpscriptsmall.com/ Vendor Software: https://www.phpscriptsmall.com/product/entrepreneur-job-portal-script/ Software Link:...

Basic B2B Script 2.0.0 - Cross-Site Scripting

Basic B2B Script 2.0.0 - Cross-Site Scripting. CVE-2018-14541. Webapps exploit for PHP platform Exploit Title: PHP Scripts Mall Basic B2B Script 2.0.0 has Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields. Date: 20.07.2018 Site Titel : B2B Script Vendor...

PHP Template Store Script 3.0.6 - Cross-Site Scripting

PHP Template Store Script 3.0.6 - Cross-Site Scripting Exploit Title: PHP Template Store Script- 3.0.6 - Stored XSS via Addres ,Bank Name,and A/c Holder Name Date: 02.08.2018 Site Titel : Exclusive Scripts Vendor Homepage: https://www.phpscriptsmall.com/ Software Link:...

PHP Template Store Script 3.0.6 Cross Site Scripting

Exploit Title: PHP Template Store Script- 3.0.6 - Stored XSS via Addres ,Bank Name,and A/c Holder Name Date: 02.08.2018 Site Titel : Exclusive Scripts Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: http://www.exclusivescript.com/ Category: Web Application Version: 3.0.6 Exploit...

Basic B2B Script 2.0.0 Cross Site Scripting

Exploit Title: PHP Scripts Mall Basic B2B Script 2.0.0 has Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields. Date: 20.07.2018 Site Titel : B2B Script Vendor Homepage: https://www.phpscriptsmall.com/ Vendor Software :...

Chartered Accountant : Auditor Website 2.0.1 - Cross-Site Scripting

Chartered Accountant : Auditor Website 2.0.1 - Cross-Site Scripting. CVE-2018-13256. Webapps exploit for PHP platform. Tags: Cross-Site Scripting XSS Exploit Title: Chartered Accountant : Auditor Website 2.0.1 - Reflected , Stored XSS Date: 26.06.2018 Site Titel : Find your needs on Domain Name...

Chartered Accountant : Auditor Website 2.0.1 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Chartered Accountant : Auditor Website 2.0.1 - Reflected , Stored XSS Site Titel : Find your needs on Domain Name Vendor Homepage: https://www.phpscriptsmall.com/ Software Link:...

Chartered Accountant : Auditor Website 2.0.1 Cross Site Scripting

Exploit Title: Chartered Accountant : Auditor Website 2.0.1 - Reflected , Stored XSS Date: 26.06.2018 Site Titel : Find your needs on Domain Name Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/cms-auditor-website/ Category: Web Application...

Reconnaissance and Vulnerability Scanning Tool: Raccoon

Raccoon is a tool made for reconnaissance and information gathering with an emphasis on simplicity. It will do everything from fetching DNS records, retrieving WHOIS information, obtaining TLS data, detecting WAF presence and up to threaded dir busting and subdomain enumeration. Every scan output...

Unrestricted file upload

Unrestricted file upload vulnerability in "op/op.UploadChunks.php" in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows remote attackers to execute arbitrary code by uploading a file with an executable extension specified by the "qqfile" parameter. This allows an authenticated attacker to...

CVE-2018-12940

SeedDMS before 5.1.8 has an unrestricted file upload in the file op/op.UploadChunks.php (parameter qqfile ). An authenticated attacker can upload a file with an executable extension, upload a malicious PHP payload, and execute OS commands from the web root. This vulnerability is documented as CVE...

Apache TomEE console (tomee-webapp) XSS Vulnerability

Apache TomEE is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomee";...

Lenovo XClarity Administrator Parameter Injection Vulnerability

Lenovo XClarity Administrator LXCA is a centralized resource management solution from Lenovo, China. The solution supports simplified infrastructure management, faster server response, and improved performance of Lenovo server systems. A parameter injection vulnerability exists in the Web API in...