CVE-2018-10080

Secutech RiS-11, RiS-22, and RiS-33 devices with firmware V5.07.52esFRI01 allow DNS settings changes via a goform/AdvSetDns?GO=wandns.asp request in conjunction with a crafted admin cookie...

Cross site request forgery (csrf)

Secutech RiS-11, RiS-22, and RiS-33 devices with firmware V5.07.52esFRI01 allow DNS settings changes via a goform/AdvSetDns?GO=wandns.asp request in conjunction with a crafted admin cookie...

Secutech RiS-11, RiS-22 and RiS-33 DNS Change Vulnerabilities

The Secutech RiS-11, RiS-22 and RiS-33 are all wireless access point devices from Secutech Venezuela. A security vulnerability exists in the Secutech RiS-11, RiS-22 and RiS-33 using firmware version 5.07.52esFRI01. The vulnerability can be exploited by an attacker to change DNS settings with the...

WordPress dark-mode plugin cross-site scripting vulnerability (CNVD-2018-01272)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . dark-mode plugin is used in one of the night mode plugin . A cross-site scripting vulnerability exists in...

WordPress weblizar-pinterest-feeds plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. weblizar-pinterest-feeds plugin is used in one of the plugin for displaying Pinterest data. A cross-site request...

Authentication flaw

Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie...

PT-2017-13767 · Intelbras · Intelbras Wrn 150

Name of the Vulnerable Software and Affected Versions: Intelbras WRN 150 devices affected versions not specified Description: The issue allows remote attackers to read the configuration file and bypass authentication by making a direct request for "cgi-bin/DownloadCfg/RouterCfm.cfg" with an...

Multiple XSS Vulnerabilities in PHPSHE B2C Mall System v1.5

PHPSHE online shopping mall system provides users with a low-cost, high-efficiency online shopping mall construction program. Multiple XSS vulnerabilities exist in PHPSHE B2C Mall System v1.5. An attacker can exploit this vulnerability to obtain information such as login cookies of administrative...

CVE-2017-8835

SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. An attack vector is the bauth cookie to cgi-bin/MANGA/admin.cgi. One impact is enumeration of user accounts by observing whether a sessi...

Cross-site scripting and cross-site request forgery vulnerabilities in metinfo

metinfo cms is an enterprise website management system with PHP Mysql architecture. There are cross-site scripting and cross-site request forgery vulnerabilities in metinfo. metinfocms "background settings-basic information-third-party code" form does not have token validation and effective...

Stored XSS Vulnerability in OurPHP

OurPHP is a web content management system developed using the PHP language. A stored XSS vulnerability exists in OurPHP version V1.7.1, which can be exploited to insert cross-site code in the member center and obtain sensitive information from the administrator cookie...

Cross site scripting

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipityeventxsstrust plugin and a setconfig error in that plugin...

CVE-2017-8102

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipityeventxsstrust plugin and a setconfig error in that plugin...

CVE-2017-8102

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipityeventxsstrust plugin and a setconfig error in that plugin...

CVE-2017-8102

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipityeventxsstrust plugin and a setconfig error in that plugin...

CVE-2017-8102

Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin’s cookie and other information by crafting a new entry as an editor user. The root cause is related to the absence of the serendipity_event_xsstrust plugin and a set_config error in that plugin. No explicit remediation is pro...

miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post)

miniblog 1.0.1 - Cross-Site Request Forgery Add New Post Exploit Title : miniblog 1.0.1 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : Date : 09/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.spyka.net/scripts/php/miniblog Software link :...

miniblog 1.0.1 Cross Site Request Forgery

Exploit Title : miniblog 1.0.1 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : Date : 09/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.spyka.net/scripts/php/miniblog Software link : http://dl.spyka.co.uk/scripts/php/miniblog-1-0-1.zip Description admin...

Fortinet FortiWAN Information Disclosure Vulnerability

Fortinet FortiWAN is a WAN link load balancing product developed by Fortinet. An information disclosure vulnerability exists in Fortinet FortiWAN. An attacker can exploit this vulnerability by executing a GET request on the /linkreport/tmp/adminglobal page to obtain an administrator login cookie...

Multiple Blue Coat Systems SSL Visibility Appliance Product Sensitive Information Vulnerabilities

Blue Coat Systems SSL Visibility Appliance SV800 and others are SSL visibility appliances from Blue Coat Systems, USA, which are at the heart of encrypted traffic management, providing visibility into SSL traffic and supporting the addition of SSL inspection capabilities to advanced threat...