Cross site request forgery (csrf)

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

Code injection

A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device, which could lead to the disclosure of confidential information...

CVE-2018-6408

An issue was discovered on Conceptronic CIPCAMPTIWL V3 0.61.30.21 devices. CSRF exists in hy-cgi/user.cgi, as demonstrated by changing an administrator password or adding a new administrator account...

CVE-2018-5976

Cross Site Request Forgery CSRF exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password...

CVE-2018-5976

Cross Site Request Forgery CSRF exists in RSVP Invitation Online 1.0 via function/account.php, as demonstrated by modifying the admin password...

RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for php platform in category web applications 0day.today 2018-03-17...

Asus Unauthenticated LAN Remote Command Execution

Vulnerabilities Summary The following advisory describes two 2 vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE POWERFUL USER-FRIENDLY INTERFACE – The enhanced ASUSWRT...

RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin)

...

CVE-2018-6000

An issue was discovered in AsusWRT before 3.0.0.4.38410007. The dovpnuploadpost function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon or enable infosvr command mode,...

AsusWRT Router < 3.0.0.4.380.7743 - LAN Remote Code Execution

Unauthenticated LAN remote code execution in AsusWRT Discovered by Pedro Ribeiro [email protected], Agile Information Security ================================================================================= Disclosure: 22/01/2018 / Last updated: 25/01/2018 Background and summary AsusWRT is the...

YzmCMS_v3.6 Arbitrary File Deletion Vulnerability

YzmCMS is a lightweight and open source content management system based on PHP+Mysql architecture, running on Linux, Windows, MacOSX, Solaris and other platforms. YzmCMSv3.6 has an arbitrary file deletion vulnerability. Attackers by cracking the background default account password , construct URL...

CVE-2014-5334

FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login...

CVE-2014-5334

CVE-2014-5334 affects FreeNAS prior to 9.3-M3, where the WebGUI can be accessed with a blank admin password. This allows remote attackers to gain root privileges via the WebGUI login. The description explicitly states the administrator password may be blank, enabling web-based authentication bypa...

CVE-2017-15112

In keycloak-http-client-install prior to version 0.8, the admin password could be provided through a command-line argument. This might result in the password being leaked through shell history, or becoming visible to a local attacker at the time the program is running...

Variable Override Vulnerability in MetInfo Version 5.3.19 at Password Retrieval

MetInfo is a Content Management System CMS developed using PHP and Mysql. A variable override vulnerability exists in MetInfo version 5.3.19 at the password retrieval. An attacker can exploit the vulnerability to obtain a password reset link, bypass authentication to change the administrator...

Sendroid Bulk SMS Portal / Marketing Script 6.5.0 SQL Injection

Exploit Title: Sendroid - Bulk SMS Portal, Marketing Script 5.0.0 - 6.5.0 - SQL Injection Google Dork: "welcome to SMS portal" Date: 22/12/2017 Exploit Author: Onwuka Gideon Contact: http://twitter.com/@gideononwuka Vendor Homepage: http://ynetinteractive.com/ Software Buy:...

Sendroid 6.5.0 - SQL Injection

Sendroid 6.5.0 - SQL Injection Exploit Title: Sendroid - Bulk SMS Portal, Marketing Script 5.0.0 - 6.5.0 - SQL Injection Google Dork: "welcome to SMS portal" Date: 22/12/2017 Exploit Author: Onwuka Gideon Contact: http://twitter.com/@gideononwuka Vendor Homepage: http://ynetinteractive.com/...

Sendroid < 6.5.0 - SQL Injection

Exploit Title: Sendroid - Bulk SMS Portal, Marketing Script 5.0.0 - 6.5.0 - SQL Injection Google Dork: "welcome to SMS portal" Date: 22/12/2017 Exploit Author: Onwuka Gideon Contact: http://twitter.com/@gideononwuka Vendor Homepage: http://ynetinteractive.com/ Software Buy:...

Cambium Networks cnPilot File Path Traversal Vulnerability

Cambium Networks cnPilot is a cloud-enabled managed single-band router product from Cambium Networks, USA. web administrative console is one of the web administration console programs. A path traversal vulnerability exists in the 'ping' and 'traceroute' functions of the Web administrative console...