CVE-2018-9991: Improper Neutralization of Input During Web Page Generation

Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter...

CVE-2018-9925

An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request...

Frog CMS 0.9.5 - Cross-Site Request Forgery (Add User)

Exploit Title: Cross Site Request Forgery- Frog CMS Date: 31-03-2018 Exploit Author: Samrat Das Contact: http://twitter.com/SamratDas93 Website: https://securitywarrior9.blogspot.in/ Vendor Homepage: https://github.com/philippe/FrogCMS Version: 0.9.5 CVE : CVE-2018-8908 Category: Webapp CMS 1...

CVE-2018-8908

An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens...

PT-2018-18707

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5 Description The issue is related to the lack of an anti-CSRF token in state modification requests, specifically in the "add user" functionality. This allows a malicious user to craft an HTML page that can trick a victim...

CVE-2018-8908: Cross-Site Request Forgery (CSRF)

An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens...

QuickAppsCMS Cross-Site Request Forgery Vulnerability

QuickAppsCMS is an open source content management system CMS developed using the MVC framework. A cross-site request forgery vulnerability exists in admin/user/manage/add in QuickAppsCMS version 2.0.0-beta2. A remote attacker can exploit this vulnerability to create an account with administrator...

PT-2018-18857

Name of the Vulnerable Software and Affected Versions QuickAppsCMS version 2.0.0-beta2 Description The issue allows an unauthorized remote attacker to create an account with admin privileges due to a CSRF vulnerability in the /admin/user/manage/add API endpoint. Recommendations For QuickAppsCMS...

CVE-2018-9108: Cross-Site Request Forgery (CSRF)

CSRF in /admin/user/manage/add in QuickAppsCMS 2.0.0-beta2 allows an unauthorized remote attacker to create an account with admin privileges...

Ubiquiti Inc.: UniFi Video Server web interface admin user Firmware Update path traversal leading to local system compromise

The UniFi Video Server for Windows web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware update information. If the...

PT-2018-18650

Name of the Vulnerable Software and Affected Versions enhavo version 0.4.0 Description The issue allows for a cross-site scripting XSS attack via a user-group that contains executable JavaScript code in the user-group name. This attack is launched when a victim visits the "admin user group" page...

CVE-2018-8832: Improper Neutralization of Input During Web Page Generation

enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...

QQQ SYSTEMS vulnerable to cross-site scripting

Overview QQQ SYSTEMS provided by Gundam Cult QQQ is a CGI script to create quiz pages. QQQ SYSTEMS contains a stored cross-site scripting vulnerability CWE-79. When an administrative user of the software accesses a malicious page created by an attacker, an arbitrary script may be executed. Note...

PT-2018-18244

Name of the Vulnerable Software and Affected Versions: YxtCMF version 3.1 Description: An issue was discovered in YxtCMF, where the RbacController.class.php file is vulnerable to CSRF attacks. This allows an attacker to modify an administrator account via the "index.php/admin/user/add post.html"...

CVE-2018-7733: Cross-Site Request Forgery (CSRF)

An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/addpost.html...

School Management Script 3.0.4 SQL Injection

Exploit Title: SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4. Date: 26/02/2018 Exploit Author: Samiran Santra Vendor Homepage: https://www.phpscriptsmall.com Software Link: https://www.phpscriptsmall.com/product/school-management-system Version: v3.0.4 Tested on: Windows...

HPE iLO 4 < 2.53 - Add New Administrator User

!/usr/bin/env python """ Exploit trigger was presented @reconbrx 2018 Vulnerability found and documented by synacktiv: https://www.synacktiv.com/posts/exploit/rce-vulnerability-in-hp-ilo.html Original advisory from HP: https://support.hpe.com/hpsc/doc/public/display?docId=hpesbhf03769enus Other...

Synology Photostation 6.7.2-3429 - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Synology PhotoStation Multiple Vulnerabilities", 'Description' = %q This module exploits multiple vulnerabilities in Synology PhotoStation. When...

Synology Photostation 6.7.2-3429 - Remote Code Execution (Metasploit)

Synology Photostation 6.7.2-3429 - Remote Code Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Synology PhotoStation Multiple Vulnerabilities", 'Description' = %q This modul...

SA161: Local Information Disclosure Due to Meltdown and Spectre Attacks

SUMMARY Symantec Network Protection products, which run on an affected CPU chipset and execute arbitrary code from external sources, are susceptible to several information disclosure vulnerabilities aka Meltdown and Spectre attacks. A remote attacker, with the ability to execute arbitrary code...