CVE-2022-44586: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS in Ayoub Media AM-HiLi plugin = 1.0 on WordPress...

CVE-2021-36858: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Themepoints Testimonials plugin = 2.6 on WordPress...

CVE-2022-40311: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS in Fatcat Apps Analytics Cat plugin = 1.0.9 on WordPress...

CVE-2021-36827: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Saturday Drive's Ninja Forms Contact Form plugin = 3.6.9 at WordPress via "label"...

CVE-2019-17431

An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...

CVE-2019-17431: Cross-Site Request Forgery (CSRF)

An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...

Design/Logic Flaw

An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie admin-auth is stored on a victim's computer results in the admin password being discoverable by a local attacker, and usable to gain administrative access to the victim's router...

CVE-2019-7311: Missing Encryption of Sensitive Data

An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie admin-auth is stored on a victim's computer results in the admin password being discoverable by a local attacker, and usable to gain administrative access to the victim's router...

CVE-2019-11077: Cross-Site Request Forgery (CSRF)

FastAdmin V1.0.0.20190111beta has a CSRF vulnerability to add a new admin user via the admin/auth/admin/add?dialog=1 URI...

PT-2015-6737

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy versions 6.0 through 6.0.1.x before 6.0.1.10 IBM UrbanCode Deploy versions 6.1.1.x before 6.1.1.8 Description The issue allows remote authenticated users to gain privileges by leveraging the ability to create and execute a...

CVE-2013-2645

CVE-2013-2645 affects the TP-LINK WR1043N router (firmware TL-WR1043ND_V1_120405). Multiple CSRF vulnerabilities allow remote attackers to hijack administrator authentication by crafting requests that alter FTP settings and bandwidth controls (e.g., shareEntire to enable FTP, nas_admin_pwd to cha...

lulieblog 1.2 - Multiple Vulnerabilities

No description provided by source. LulieBlog 1.2 Multiple Remote Vulnerabilities Admin Auth Bypass, Upload File, Blind SQL Injection Author: Cod3rZ Site: http://cod3rz.helloweb.eu Site: http://devilsnight.altervista.org Date: 06/05/2008 dd/mm/yyyy Admin Auth Bypass: Modify Articles: send a reques...

[oss-security] CVE request: various NodeJS module vulnerabilities

Hi all, This is a request for CVEs for the following vulnerabilities discovered by the Node Security Project. I left out their advisories where I could find an assigned CVE; CVE-2013-7370 CVE-2013-7371 CVE-2013-6393 CVE-2013-4660 https://nodesecurity.io/advisories printer potential command...

Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability

Document Title: =============== Monstra CMS v1.2.0 - Blind SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1081 Release Date: ============= 2013-09-19 Vulnerability Laboratory ID VL-ID: ==================================== 108...

Edimax IC-3030iWn - UDP Packet Password Information Disclosure

Edimax IC-3030iWn - UDP Packet Password Information Disclosure source: https://www.securityfocus.com/bid/54006/info Edimax IC-3030iWn is prone to an information-disclosure vulnerability. Successful exploits will allow a remote attacker to gain access to sensitive information. Information obtained...

Edimax IC-3030iWn Web Admin Auth Bypass exploit

Exploit for hardware platform in category web applications This exploit against: - Edimax IC-3030i - Edimax IC-3015 - Airlive WN 500 !/usr/bin/env python """ Exploit Title: Edimax IC-3030iWn Web Admin Auth Bypass exploit Date: 4 April 2012 Exploit Author: email protected, @y3dips URL:...

KLA10101 SB vulnerabilities in Cerberus FTP Server

A CSRF vulnerability was found in the Cerberus FTP Server. By exploiting this vulnerability malicious users can hijack the administrators’ auth. This vulnerability can be exploited from the network at a point related to the web interface. Original advisories - Exploitation Related products...

Bintech Systems LLC SQL Injection

Exploit Title: Bintech Systems LLC Admin Auth Bypass Exploit Google Dork: "Powered By: Bintech Systems LLC" Date: 11-03-2012 Author: BLACK BURN BBHH Tested on: Linux Exploit : http://localhost/ptah/login.asp user: 'or''=' pass: 'or''=' Demo :...

Bintech Systems LLC SQL Injection

Exploit for asp platform in category web applications Exploit Title: Bintech Systems LLC Admin Auth Bypass Exploit Google Dork: "Powered By: Bintech Systems LLC" Date: 11-03-2012 Author: BLACK BURN BBHH Tested on: Linux Exploit : http://localhost/ptah/login.asp user: 'or''=' pass: 'or''=' Demo :...

Paddelberg Topsite Script Insecure Cookie

Exploit Title: Paddelberg's topsite-script admin auth bypass. Google Dork: intext:"powered by php scripte webmaster resource" Date: 8. 1. 2012 Author: Christian Inci Software Link: http://www.paddelberg.de/gratis-toplisten-script/gratis-download/ Version: = 1.23 22. 9. 2007 Tested on: 1.23 Vendor...