PT-2023-28647 · WordPress · Url Shortify

Name of the Vulnerable Software and Affected Versions: URL Shortify WordPress plugin versions prior to 1.7.6 Description: The issue allows an unauthenticated attacker to inject malicious javascript that will trigger in the plugin's admin panel with statistics of the created short link, due to the...

CVE-2022-21705 Authenticated remote code execution in octobercms

Octobercms is a self-hosted CMS platform based on the Laravel PHP Framework. In affected versions user input was not properly sanitized before rendering. An authenticated user with the permissions to create, modify and delete website pages can exploit this vulnerability to bypass cms.safemode /...

Code Injection in microweber/microweber

Description HTML Injection is a vulnerability in which the attacker can inject malicious html content in the webpage. Proof of Concept 1 Admin has enabled Comments module, so that people can comment on a blog post. 2 Attacker post the following comment: SOMETHING+SOMETHING Now, observe the change...

CVE-2021-38143

CVE-2021-38143 (Form Tools) affects Form Tools up to version 3.0.20. An issue allows stored XSS: when an administrator creates a customer account, the customer can log in and change the name/last name fields; these fields are vulnerable to XSS payload insertion and the attack is triggered in the ...

CVE-2021-28128

Strapi up to version 3.6.0 contains an auth weakness in the admin panel: a user can change their own password without entering the current one. If an attacker gains any valid session, they can take over the account by changing the password. This aligns with the CVSS3.1/8.1 (HIGH) impact noted in ...

CVE-2020-9591

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel...

Transcend Wi-Fi SD Card Cross Site Request Forgery / Traversal Vulnerabilities

Transcend Wi-Fi SD Card 16GB with firmware 1.8 suffers from cross site request forgery and directory traversal vulnerabilities. There are Directory Traversal and Cross-Site Request Forgery vulnerabilities in Transcend Wi-Fi SD Card. ------------------------- Affected products:...

BookingWizz Booking System 5.5 - 'id' SQL Injection

Exploit Title: BookingWizz Booking System 5.5 - 'bs-services-add.php' SQL Injection Dork: N/A Date: 27.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/booking-system/87919 Version: 5.5 Category: Webapps Tested on: Kali linux Description : The service...

CVE-2018-10121

plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=editpage&name=error404 aka Edit 404 page action...

Cross site request forgery (csrf)

PHP Scripts Mall Professional Service Script has CSRF via admin/generalsettingupd.php, as demonstrated by modifying a setting in the user panel...

Shiksha Education Website Script SQL Injection

Vulnerability: SQL Injection + Authentication Bypass Date: 18.01.2017 Vendor Homepage: http://www.scriptgiant.com/ Script Name: Shiksha Educational Website Script Script Buy Now: http://www.popularclones.com/products/Shiksha-Educational Author: Ihsan Sencan Author Web: http://ihsan.net Mail :...

Online Airline Booking System - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title : Online Airline Booking System multiple vulnerabilities Author : WICS Date : 05/1/2016 Software Link : http://sourceforge.net/projects/oabs/ Affected Version: All Overview: The Online Airline Booking System is designed to be an...

Apache Solr < 5.1 Multiple XSS

Binary data 8975.prm...

Simple File Manager 024 - Authentication Bypass

Exploit Title: Simple File Manager v.024 Login Bypass Vulnerability Date Published: 2013/6/17 Exploit Author: Chako Software Link: http://onedotoh.sourceforge.net/ Version: v.024 Doesn't work on v.025 Description: ===================== A vulnerability has been identified in Simple File Manager...

Plogger - Multiple Input Validation Vulnerabilities

Plogger - Multiple Input Validation Vulnerabilities source: https://www.securityfocus.com/bid/58271/info Plogger is prone to following input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data: 1. An SQL-injection vulnerability 2. Multiple cross-site scripting...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/currencies.php in osCSS 1.2.2, and probably earlier versions, allows remote attackers to inject arbitrary web script or HTML via the page parameter...

SmartBlog 1.3 - index.php SQL Injection

SmartBlog 1.3 - index.php SQL Injection Smartblog remote SQL injection exploit Script download : http://ftp1.toocharger.com/scfQ9NS/smartblog3868.zip Founder: His0k4 ALGERIAN HACKER Greetz : All friends & muslims HaCkErS... Contact: His0k4.hlmatgmail.com Dork : Actionnée par smartblog P.O.C :...