2398 matches found
tp5cms Cross-site Scripting Vulnerability
tp5cms is a content management system CMS framework written in the PHP language and based on technologies such as ThinkPHP, swiper and bootstrap. A cross-site scripting vulnerability exists in tp5cms 2017-05-25 and earlier versions. A remote attacker can exploit this vulnerability to inject...
CMSeeK v1.0.7 - CMS Detection And Exploitation Suite (Scan WordPress, Joomla, Drupal And 50 Other CMSs)
What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.0.7 07-08-2018 - Version 1.0.6...
OneThink Cross-Site Request Forgery Vulnerability
Onethink is a ThinkPHP-based content management framework for web development . A cross-site request forgery vulnerability exists in the admin.php?s=/AuthManager/addToGroup.html page in OneThink version 1.1. A remote attacker can exploit this vulnerability to gain administrator privileges...
Ukcms File Upload Vulnerability
UKcms is a content management system CMS written in the PHP language. A file upload vulnerability exists in UKcms 1.1.7 and earlier versions. The vulnerability stems from the program not strictly filtering the type of file uploads. An attacker can exploit this vulnerability by changing the...
Multiple cross-site scripting vulnerabilities in GROWI
Overview GROWI provided by WESEEK, Inc. contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in the UserGroup Management section of admin page CWE-79 - CVE-2018-0652 Stored cross-site scripting vulnerability in Wiki page view CWE-79 -...
ASUS WL-330NUL Cross-Site Request Forgery Vulnerability
The WL-330NUL is a portable wireless LAN router offered by ASUS Japan. The ASUS WL-330NUL suffers from a cross-site request forgery vulnerability that could allow a user to perform unexpected actions on the device if they view a malicious page while logged into the administration screen...
Design/Logic Flaw
An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add...
laverastit.fi XSS vulnerability
Open Bug Bounty ID: OBB-638032 Description| Value ---|--- Affected Website:| laverastit.fi Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
portfolioCMS any.php file upload vulnerability
portfolioCMS is a content management system CMS based on PHP and MySQL. A security vulnerability exists in portfolioCMS version 1.0.5. An attacker can exploit the vulnerability to upload arbitrary .php files with the help of admin/portfolio.php?newpage=true URI...
Cross site scripting
The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...
CVE-2018-11485
The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...
Auto Dealership & Vehicle Showroom WebSys 1.0 - XSS / CSRF / Authentication Bypass Vulnerabiliti
Exploit for php platform in category web applications Exploit Title: Auto Dealership & Vehicle Showroom WebSys 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin panel Authentication bypass Exploit Author: Borna nematzadeh L0RD or email protected Vendor Homepage:...
Superfood 1.0 - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: Superfood - Restaurants & Online Food Order System 1.0 - Persistent cross site scripting / Cross site request forgery / Admin panel Authentication bypass Date: 2018-05-20 Exploit Author: Borna nematzadeh L0RD or email protected...
Auto Dealership & Vehicle Showroom WebSys 1.0 - Multiple Vulnerabilities
Exploit Title: Auto Dealership & Vehicle Showroom WebSys 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin panel Authentication bypass Date: 2018-05-21 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage:...
CVE-2018-10737
A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter...
TheDoc - Simple But Very Useful SQLMAP Automator With Built In Admin Finder, Hash Cracker (Using Hashcat) And More!
TheDoc is a simple but very useful SQLMAP automator with built in admin finder, hash crackerusing hashca and more! Abilities: Counts total injections tried. Crawls given domain for vulnerabilties. Extracts Database Infos via injection URL Extract Users, Passwords & emails via injection URL Extrac...
CVE-2018-1000172
Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting XSS vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45...
CVE-2018-10430
An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...
WordPress User Profile&Membership Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports PHP and MySQL server set up a personal blog site.User Profile&Membership plugin is used in one of the website membership registration plugin. A cross-site scripting...