GoAhead 2.5.0 - Host Header Injection

Exploit Title: GoAhead Web server HTTP Header Injection. Shodan Query: Server: Goahead Discovered Date: 05/07/2019 Exploit Author: Ramikan Vendor Homepage: https://www.embedthis.com/goahead/ Affected Version: 2.5.0 may be others. Tested On Version: 2.5.0 in Cisco Switches and Net Gear routers...

Jspxcms has a file upload vulnerability (CNVD-2019-40540)

Jspxcms is a scalable enterprise-class open source web content management system CMS. Jspxcms has a file upload vulnerability that can be exploited by an attacker to gain control of the web server...

thesystem App 1.0 - Persistent Cross-Site Scripting

thesystem App 1.0 - Persistent Cross-Site Scripting Exploit Title: thesystem App 1.0 - Persistent Cross-Site Scripting Author: İsmail Güngör Discovery Date: 2019-09-26 Vendor Homepage: https://github.com/kostasmitroglou/thesystem Software Link: https://github.com/kostasmitroglou/thesystem Tested...

Code Execution Vulnerability in TurboMail

TurboMail is developed by Guangzhou Topo Software Technology Co., Ltd. for the enterprise and public institution communication needs and the development of e-mail server system. TurboMail code execution vulnerability, an attacker can use this vulnerability to obtain control of the web server...

File Upload Vulnerability in LJCMS

LJCMS is a free and open source content management system. LJCMS suffers from a file upload vulnerability that can be exploited by an attacker to gain control of a web server...

thesystem App 1.0 Cross Site Scripting

Exploit Title: thesystem App 1.0 - Persistent Cross-Site Scripting Author: İsmail Güngör Discovery Date: 2019-09-26 Vendor Homepage: https://github.com/kostasmitroglou/thesystem Software Link: https://github.com/kostasmitroglou/thesystem Tested Version: 1.0 Tested on OS: Windows 10 CVE: N/A...

Code Execution Vulnerability in ShuipFCMS

ShuipFCMS is a content management system based on ThinkPHP framework as the core and developed in an independent grouping approach. ShuipFCMS suffers from a code execution vulnerability that can be exploited by an attacker to gain control of the web server...

thesystem App 1.0 - Persistent Cross-Site Scripting

Exploit Title: thesystem App 1.0 - Persistent Cross-Site Scripting Author: İsmail Güngör Discovery Date: 2019-09-26 Vendor Homepage: https://github.com/kostasmitroglou/thesystem Software Link: https://github.com/kostasmitroglou/thesystem Tested Version: 1.0 Tested on OS: Windows 10 CVE: N/A...

thesystem App 1.0 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: thesystem App 1.0 - Persistent Cross-Site Scripting Author: İsmail Güngör Vendor Homepage: https://github.com/kostasmitroglou/thesystem Software Link: https://github.com/kostasmitroglou/thesystem Tested Version: 1.0 Tested on OS...

ALPINE-CVE-2019-10092

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with...

Hardcoded credentials

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs Network Video Recorders, which can be accessed without authentication over the network...

CVE-2019-13523

In Honeywell Performance IP Cameras and Performance NVRs, the integrated web server of the affected devices could allow remote attackers to obtain web configuration data in JSON format for IP cameras and NVRs Network Video Recorders, which can be accessed without authentication over the network...

CVE-2019-13523

CVE-2019-13523 affects Honeywell Performance IP Cameras and Performance NVRs where the integrated web server can disclose web configuration data in JSON without authentication. Affected IP Cameras include HBD3PR2, H4D3PRV3, HED3PR3, H4D3PRV2, HBD3PR1, H4W8PR2, HBW8PR2, H2W2PC1M, H2W4PER3, H2W2PER...

Easy File Sharing Web Server 7.2 SEH Buffer Overflow Exploit

!/usr/bin/python Exploit Title: Easy File Sharing Web Server 7.2 local SEH overflow Exploit Author: x00pwn Vendor Homepage: http://www.sharing-file.com/ Software Link: http://www.sharing-file.com/efssetup.exe Version: 7.2 Tested on: Windows 7 Exploit summary: When adding a new user to the...

CVE-2019-12659

A vulnerability in the HTTP server code of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the HTTP server to crash. The vulnerability is due to a logical error in the logging mechanism. An attacker could exploit this vulnerability by generating a high amount of...

CVE-2019-12656

A vulnerability in the IOx application environment of multiple Cisco platforms could allow an unauthenticated, remote attacker to cause the IOx web server to stop processing HTTPS requests, resulting in a denial of service DoS condition. The vulnerability is due to a Transport Layer Security TLS...

Race condition

A vulnerability in the IOx application environment of multiple Cisco platforms could allow an unauthenticated, remote attacker to cause the IOx web server to stop processing HTTPS requests, resulting in a denial of service DoS condition. The vulnerability is due to a Transport Layer Security TLS...

CVE-2019-12668

Cisco IOS and IOS XE Software contain a stored cross-site scripting (XSS) vulnerability in the web framework banner handling. An authenticated, remote attacker can craft and save a banner parameter to trigger XSS in the web interface, potentially executing script code or exposing browser-based in...

CVE-2019-12667 Cisco IOS XE Software Stored Cross-Site Scripting Vulnerability

A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the web interface of the affected software. The vulnerability is due to insufficient input validation of some...

CVE-2019-12667

CVE-2019-12667 affects Cisco IOS XE Software with stored XSS in the web interface’s web framework due to insufficient input validation of parameters. An authenticated user could be targeted by phishing or spoofed requests to inject script, potentially executing code in the browser context or acce...