1416 matches found
WordPress Plugin Form Maker 1.12.24 - SQL Injection
Title: WordPress Form Maker Plugin 1.12.24 - SQL Injection Date: 2018-06-07 Author: Neven Biruski Software: WordPress Form Maker plugin https://wordpress.org/plugins/form-maker/ Version: 1.12.24 and below Vendor Status: Vendor contacted, update released The easiest way to reproduce the SQL...
CVE-2018-11633
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...
wityCMS 0.6.1 - Cross-Site Scripting
Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field Date: 05/28/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: https://creatiwity.net/witycms Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.1 Version: 0.6.1 Tested on:...
CVE-2018-11512: Improper Neutralization of Input During Web Page Generation
Stored cross-site scripting XSS vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to...
CVE-2018-10136
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
Cross site scripting
NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php...
CVE-2018-5687
NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php...
Deconf: Reflected XSS in admin settings
The researcher and our team determined that actually there wasn't any applicable vulnerability...
PHP Scripts Mall Single Theater Booking Cross-Site Request Forgery Vulnerability
PHP Scripts Mall Single Theater Booking is an open source theater script. A cross-site request forgery vulnerability exists in PHP Scripts Mall Single Theater Booking. A remote attacker can use the admin/sitesettings.php file to change sensitive settings on the user panel, or even inject web scri...
CVE-2017-17930
PHP Scripts Mall Professional Service Script has CSRF via admin/generalsettingupd.php, as demonstrated by modifying a setting in the user panel...
CVE-2017-1002012
Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/adminsetting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement...
VACRON VIG-US731VE 1.0.18-09-B727 IP Camera - Authentication Bypass
VACRON VIG-US731VE 1.0.18-09-B727 IP Camera - Authentication Bypass Exploit Title: IP Camera VACRON VIG-US731VE Date: 2017-07-18 Exploit Author: anonymous Vendor Homepage: www.vacron.com Version: V1.0.18-09-B727 1. doesn't require credentials to fetch snapshot like this:...
BigTree-CMS 4.2.x < 4.2.17 Multiple Vulnerabilities
Binary data 700143.prm...
Sql injection
Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack...
CVE-2017-7360
Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack...
CVE-2017-6918
CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Navigation Social can be changed...
Cross site request forgery (csrf)
CSRF exists in BigTree CMS 4.1.18 with the nav-social parameter to the admin/settings/update/ page. The Navigation Social can be changed...
CVE-2017-6918
CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Navigation Social can be changed...