CVE-2018-19332

An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability that can add a new user via the admin/ajax.php?type=member&action=add URI...

PT-2018-14897 · Phpbb Limited · Phpbb

Name of the Vulnerable Software and Affected Versions: phpBB versions prior to 3.2.4 Description: The issue allows for Remote Code Execution through Object Injection by utilizing Phar deserialization. This can be achieved by passing an absolute path to a file exists check. The exploitation of thi...

Electricks eCommerce 1.0 Cross Site Scripting

Exploit Title: Electricks eCommerce 1.0 - Cross-Site Scripting Date: 2018-11-12 Exploit Author: Nawaf Alkeraithe Software Link: https://www.sourcecodester.com/sites/default/files/download/billyblue/electricks.zip Version: 1.0 When a user signs up for an account on the following url:...

Electricks eCommerce 1.0 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Electricks eCommerce 1.0 - Cross-Site Scripting Exploit Author: Nawaf Alkeraithe Software Link: https://www.sourcecodester.com/sites/default/files/download/billyblue/electricks.zip Version: 1.0 When a user signs up for an accoun...

Electricks eCommerce 1.0 - Persistent Cross-Site Scripting

Electricks eCommerce 1.0 - Persistent Cross-Site Scripting Exploit Title: Electricks eCommerce 1.0 - Cross-Site Scripting Date: 2018-11-12 Exploit Author: Nawaf Alkeraithe Software Link: https://www.sourcecodester.com/sites/default/files/download/billyblue/electricks.zip Version: 1.0 When a user...

EdTv 2 - id SQL Injection

EdTv 2 - id SQL Injection Exploit Title: EdTv 2 - 'id' SQL Injection Dork: N/A Date: 2018-11-12 Exploit Author: Ihsan Sencan Vendor Homepage: http://edtv.edsup.org/ Software Link: https://ayera.dl.sourceforge.net/project/edtv/beta/edtv2go.zip Version: 2 Category: Webapps Tested on:...

CVE-2018-19228

An issue was discovered in LAOBANCMS 2.0. It allows arbitrary file deletion via ../ directory traversal in the admin/pic.php del parameter, as demonstrated by deleting install/install.txt to permit a reinstallation...

CVE-2018-19192

An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...

CVE-2018-19051

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...

CVE-2018-19051

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...

OOP CMS BLOG 1.0 - Cross-Site Request Forgery (Add Admin)

OOP CMS BLOG 1.0 - Cross-Site Request Forgery Add Admin Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-11-06 Exploit Author: Ihsan Sencan Vendor Homepage: http://zsoft.com.bd/ Software Link:...

Waimai Super Cms Cross-Site Scripting Vulnerability (CNVD-2018-26011)

waimai Super Cms is a takeaway ordering system. The system is compatible with IE, Firefox, Chrome, Safari and Opera browsers. A cross-site scripting vulnerability exists in version 20150505 of Waimai Super Cms. A remote attacker can exploit the vulnerability by sending the 'fname' parameter to th...

CVE-2018-18722

An XSS issue was discovered in admin/content/editcontent?id=29&gopage=1 in YUNUCMS 1.1.5...

Sql injection

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/specialadd.php via a zxbigclassid cookie. This needs an admin user login...

CVE-2018-18739

CVE-2018-18739 affects SEMCMS 3.4, with a cross-site scripting vulnerability in the admin/SEMCMS_Products.php?lgid=1 Keywords field. The issue is documented across multiple sources (NVD, CNVD, CVE lists). The connected documents confirm the vulnerable component is the Keywords input in SEMCMS 3.4...

U.S. Dept Of Defense: Admin panel take over | User info leakage | Mass Comprimise

NOTE! Thanks for submitting a report! Please replace all the square sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary: add summary of the vulnerabili...

CVE-2018-18317

DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI...

LUYA CMS 1.0.12 - Cross-Site Scripting

LUYA CMS 1.0.12 - Cross-Site Scripting Exploit Title: LUYA CMS 1.0.12 - Cross-Site Scripting Date: 2018-10-11 Exploit Author: Ismail Tasdelen Vendor Homepage: https://luya.io/ Software Link : https://github.com/luyadev/luya/ Software : LUYA CMS Version : 1.0.12 Vulernability Type : Cross-site...

Cross site scripting

XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...

GitLab: [Admin Panel] CSRF to resume/pause runner

Hi, Just found a CSRF in admin panel of gitlab instance to pause/resume runner. Steps to reproduce - http://gitlabinstance/admin/runners/:runnerid/resume - http://gitlabinstance/admin/runners/:runnerid/pause Video: ███████ password: ██████████ Impact Just found a CSRF in admin panel of gitlab...