Cross site scripting

Cross-site scripting XSS vulnerability in the Users module in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Sql injection

SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2016-9413

The CVE-2016-9413 entry affects MyBB Admin control panel and MyBB Merge System prior to 1.8.7. The underlying issue is clickjacking via unspecified vectors, enabling remote attackers to perform clickjacking against affected admin interfaces. The vulnerable components are the Admin control panel a...

CVE-2016-9419

CVE-2016-9419 affects MyBB (aka MyBulletinBoard) Admin control panel and the Merge System, with vulnerable versions before 1.8.8. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected docum...

CVE-2016-9409

CV E-2016-9409 is an XSS vulnerability in the admin control panel of MyBB (and MyBB Merge System) before version 1.8.7. The flaw allows remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs. It affects MyBB prior to 1.8.7, with impact limited to client-side sc...

CVE-2016-9411

CVE-2016-9411 affects MyBB (MyBulletinBoard) Admin control panel and MyBB Merge System prior to version 1.8.7. The vulnerability allows remote attackers to disclose the installation path through vectors involving sending mails. The incident is documented in NVD with CVSS v2 base score 5.0 (Partia...

CVE-2016-9421

CVE-2016-9421 describes a cross-site scripting (XSS) vulnerability in the MyBB Admin control panel, specifically in the Users module, prior to version 1.8.8 (and MyBB Merge System prior to 1.8.8). The root cause is an XSS condition that could allow remote attackers to inject arbitrary web script ...

CVE-2015-8974

The CVE affects MyBB (MyBulletinBoard) and relates to a SQL injection in the Group Promotions module of the admin control panel. Affected versions are MyBB before 1.6.18 and 1.8.x before 1.8.6; the issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Root cause...

CVE-2016-9413

The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-9419

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9409

Cross-site scripting XSS vulnerability in the Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs...

Advanced Electron Forum 1.0.9 - Remote File Inclusion Cross-Site Request Forgery

Advanced Electron Forum 1.0.9 - Remote File Inclusion Cross-Site Request Forgery + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AEF-RFI.txt Vendor: ============================= www.anelectron.com/downloads/ Product:...

Advanced Electron Forum 1.0.9 - Remote File Inclusion / Cross-Site Request Forgery

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AEF-RFI.txt Vendor: ============================= www.anelectron.com/downloads/ Product: ================================ Advanced Electron Forum v1.0.9 AEF Exploit patched current version...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Admin Control Panel ACP login in MyBB aka MyBulletinBoard before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2015-2334

Cross-site request forgery CSRF vulnerability in the Admin Control Panel ACP login in MyBB aka MyBulletinBoard before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

MyBB 1.8.1 /admin/modules/config/language.php 跨站脚本漏洞

No description provided by source. !/usr/bin/env python coding: utf-8 import re from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register This poc requires a valid credentialcookie to the ACPAdmin Control Panel to work. class TestPOCPOCBase: vulID =...

TP-Link TL-WR740N - Denial of Service

TP-Link TL-WR740N Wireless Router MitM httpd Denial Of Service Vendor: TP-LINK Technologies Co., Ltd. Product web page: http://www.tp-link.us Affected version: - Firmware version: 3.17.0 Build 140520 Rel.75075n Released: 5/20/2014 - Firmware version: 3.16.6 Build 130529 Rel.47286n Released:...

EQdkp <= 1.3.1 (Referer Spoof) Remote Database Backup Vulnerability

No description provided by source. Title: EQdkp = 1.3.1 Referer Spoof to access to SQL Database URL: http://www.eqdkp.com Hook: Powered by EQdkp Author: Eight10 Contact: [email protected] --------------------------------------------------------------------------------------------------------...

NEXTWEB (i)Site Login.ASP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13834/info NEXTWEB iSite is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation coul...

PHPEasyData 1.5.4 - admin/login.php username Field SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/29659/info PHPEasyData is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage the cross-site scripting issues to...