Cisco Expressway Series和Cisco TelePresence Video Communication Server 安全漏洞

Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS are both products of Cisco, Inc.Cisco Expressway Series is software for accessing devices outside the firewall. The software provides simple, highly secure access for users outside the firewall, helping telecommuters wo...

Cross site request forgery (csrf)

A vulnerability in Pulse Connect Secure before 9.1R12 could allow an authenticated administrator to perform an arbitrary file delete via a maliciously crafted web request...

CVE-2021-20786

Cross-site request forgery CSRF vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote attacke...

CVE-2021-20786

CVE-2021-20786 describes a cross-site request forgery (CSRF) in GroupSession products: Free edition (versions before 5.1.0), byCloud (before 5.1.0), and ZION (before 5.1.0). The issue allows a remote attacker to hijack administrator authentication via a specially crafted URL. The root cause is a ...

Nagios XI Autodiscovery Webshell Upload

This module exploits a path traversal issue in Nagios XI before version 5.8.5 CVE-2021-37343. The path traversal allows a remote and authenticated administrator to upload a PHP web shell and execute code as www-data. The module achieves this by creating an autodiscovery job with an id field...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Software License Manager versions prior to 4.4.6 allows remote attackers to hijack the authentication of administrators via unspecified vectors...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress Currency Switcher plugin 1.1.6 and prior...

CVE-2021-32103

OpenEMR CVE-2021-32103 is a Stored XSS affecting the interface/usergroup/usergroup_admin.php path in OpenEMR versions prior to 5.0.2.1. An admin-authenticated user could inject arbitrary script/HTML via the lname parameter. The vulnerability arises from improper handling of input in the admin use...

Sourcecodester Simple College Website SQL Injection Vulnerability (CNVD-2021-95934)

Sourcecodester Simple College Website is a content management system from Sourcecodester. Sourcecodester Simple College Website suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in database-based applications, which can be exploit...

CVE-2020-28172

A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mechanism in collegewebsite/admin/ajax.php?action=login, thus gaining access to the website administrative panel...

Sql injection

A SQL injection vulnerability in Simple College Website 1.0 allows remote unauthenticated attackers to bypass the admin authentication mechanism in collegewebsite/admin/ajax.php?action=login, thus gaining access to the website administrative panel...

CVE-2021-1383

Multiple vulnerabilities in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to access the underlying operating system with root privileges. These vulnerabilities are due to insufficient input validation of certain CLI commands. An attacker could exploit these...

CVE-2021-20641

Cross-site request forgery CSRF vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started...

CVE-2021-20636

Cross-site request forgery CSRF vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted...

CVE-2021-20641

CVE-2021-20641 is a CSRF vulnerability in LOGITEC LAN-W300N/RS that lets an attacker spoof an admin session and perform unintended device changes via a crafted URL. Public sources describe the impact as affecting administrative web access, enabling authentication hijacking and potentially changin...

CVE-2021-21014

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

Online Reviewer System 1.0 SQL Injection

Exploit Title: Online Reviewer System PHPPDO - Admin Authentication Bypass Exploit Author: Richard Jones Date: 2021-01-31 Vendor Homepage: https://www.sourcecodester.com/php/12937/online-reviewer-system-using-phppdo.html Software Link:...

Online Movie Streaming 1.0 - Admin Authentication Bypass

Exploit Title: Online Movie Streaming 1.0 - Admin Authentication Bypass Exploit Author: Richard Jones Date: 2021-01-13 Vendor Homepage: https://www.sourcecodester.com/php/14640/online-movie-streaming-php-full-source-code.html Software Link:...