CVE-2017-15948

Perch Content Management System 3.0.3 allows unrestricted file upload with resultant XSS via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account...

Cross site scripting

Cross-Site Scripting exists in OctoberCMS 1.0.425 aka Build 425, allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account...

CVE-2017-15284

Cross-Site Scripting exists in OctoberCMS 1.0.425 aka Build 425, allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account...

CVE-2017-15284

Cross-Site Scripting exists in OctoberCMS 1.0.425 aka Build 425, allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution in the context of the Admin account...

OctoberCMS 1.0.425 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: OctoberCMS 1.0.425 aka Build 425 Stored XSS Vendor Homepage: https://octobercms.com/ Software Link: https://octobercms.com/download Exploit Author: Ishaq Mohammed https://packetstormsecurity.com/files/author/13150/ Contact:...

OctoberCMS 1.0.425 (Build 425) - Cross-Site Scripting

OctoberCMS 1.0.425 Build 425 - Cross-Site Scripting Exploit Title: OctoberCMS 1.0.425 aka Build 425 Stored XSS Vendor Homepage: https://octobercms.com/ Software Link: https://octobercms.com/download Exploit Author: Ishaq Mohammed https://www.exploit-db.com/author/?a=9086 Contact:...

OctoberCMS 1.0.425 (Build 425) - Cross-Site Scripting

Exploit Title: OctoberCMS 1.0.425 aka Build 425 Stored XSS Vendor Homepage: https://octobercms.com/ Software Link: https://octobercms.com/download Exploit Author: Ishaq Mohammed https://www.exploit-db.com/author/?a=9086 Contact: https://twitter.com/securityprince Website:...

CVE-2017-11351

Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account...

CVE-2017-11351

Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account...

CVE-2017-11351

Axesstel MU553S MU55XS-V1.14 devices have a default password of admin for the admin account...

CVE-2017-14262

CVE-2017-14262 affects Samsung NVR devices. Remote attackers can read the MD5 hash of the admin password via szUserName JSON data sent to cgi-bin/main-cgi and then use that hash in szUserPasswd to log in. The vulnerability is network-exposed with high impact (confidentiality/integrity/availabilit...

CVE-2017-14262

On Samsung NVR devices, remote attackers can read the MD5 password hash of the 'admin' account via certain szUserName JSON data to cgi-bin/main-cgi, and login to the device with that hash in the szUserPasswd parameter...

OPW Fuel Management Systems SiteSentinel Integra and SiteSentinel iSite Elevation of Privilege Vulnerability

The SiteSentinel Integra 100, SiteSentinel Integra 500 and SiteSentinel iSite ATG are all products that provide tank monitoring capabilities for OPW's fuel management system. An elevation of privilege vulnerability exists in OPW Fuel Management Systems SiteSentinel Integra and SiteSentinel iSite,...

Matrimony 2.7 Cross Site Request Forgery

======================================================== Matrimony 2.7 Admin account takeover Cross site request forgery Description : change password functionality in the admin panel does not check for current password and no CSRF token in place which allow an Attackers to be able to completely...

PHP Appointment Booking Script - Authentication Bypass

======================================================== Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin Proof of Concept : - http://localhost/appointment/adminlogin.php set username and password to admin' or 1=1 -- -...

SDCMS V1.1 Arbitrary Administrator Addition Vulnerability in Frontend

SDCMS is a PHP 3-in-1 website management system independently developed by Fireworks Network. SDCMS V1.1 foreground exists arbitrary administrator to add a vulnerability, an attacker can use the vulnerability in the foreground to arbitrarily add an administrator account...

CVE-2017-11743

MEDHOST Connex contains a hard-coded Mirth Connect admin credential that is used for customer Mirth Connect management access. An attacker with knowledge of the hard-coded credential and the ability to communicate directly with the Mirth Connect management console may be able to intercept sensiti...

CVE-2017-9932

Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb has a default password of admin for the admin account...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7507

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...