CVE-2018-19598

Statamic 2.10.3 allows XSS via First Name or Last Name to the /users URI in an 'Add new user' request...

Code execution vulnerability in Elefant CMS 2.0.8 backend

Elefant CMS is a PHP-based content management system CMS. The system includes features such as an events calendar, contact form, social media integration and member login. A code execution vulnerability exists in the Elefant CMS 2.0.8 backend at Add Language List, which stems from a failure to...

DEBIAN-CVE-2018-18247

Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter...

CVE-2018-18922

adduser in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/adduser.php POST request...

Grammarly Launches Public Bug Bounty Program

Online AI-based communications tool Grammarly is taking its private bug bounty program public in hopes of finding and fixing more vulnerabilities in its software. The company has run a private bug bounty program – which currently has 1,500 participants – in conjunction with HackerOne for over a...

Alumni Tracer SMS Notification - SQL Injection / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Alumni Tracer SMS Notification - SQL Injection / Cross-Site Request Forgery Add/Update Admin Exploit Author: Ihsan Sencan Vendor Homepage:...

DomainMOD cross-site scripting vulnerability (CNVD-2019-07965)

DomainMOD is an open source application for managing your domain names and other Internet assets in a central location. DomainMOD 4.11.01 suffers from a cross-site scripting vulnerability that can be exploited by an attacker via the assets/add/category.php Category Name or Stakeholder fields...

CVE-2018-20011

DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...

Default credentials

DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...

CVE-2018-20015

YzmCMS v5.2 has admin/role/add.html CSRF...

CVE-2018-20011

DomainMOD 4.11.01 has XSS via the assets/add/category.php Category Name or Stakeholder field...

Google Android out-of-bounds write vulnerability (CNVD-2019-01771)

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An out-of-bounds write vulnerability exists in HIDDevAddRecord in hiddapi.cc in Google Android 9. The vulnerability stems from a lack of boundary checking. A local attack...

CVE-2018-19914

DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field...

CVE-2018-19892

DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName, HostName, or UserName field...

CVE-2018-19892

DomainMOD 4.11.01 has a Cross-Site Scripting (XSS) vulnerability via the admin/dw/add-server.php DisplayName, HostName, or UserName fields. The Nuclei template specifies the path as /domain//admin/dw/add-server.php and describes a stored XSS that can execute arbitrary JavaScript in the victim’s b...

DomainMOD cross-site scripting vulnerability (CNVD-2019-07969)

DomainMOD is an open source application for managing your domain names and other Internet assets in a central location. A cross-site scripting vulnerability exists in DomainMOD versions 4.11.01 and earlier, which can be exploited by an attacker via the admin/dw/add-server.php DisplayName, HostNam...

CVE-2018-19853

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

CVE-2018-19853

CVE-2018-19853 describes an elevation-of-privilege flaw in hitshop (through 2014-07-15) where a storekeeper account can add an administrator via admin.php/user/add, gaining control of the whole site. Affected component: the web application’s user/add workflow; root cause: storekeeper privileges c...

CVE-2018-19853

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

Cross-site Request Forgery (CSRF)

showdoc/showdoc is vulnerable to cross-site request forgery CSRF attacks. The vulnerability exists in /api/teamMember/save where it is possible to add members to a team through CSRF attacks...