CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

Cross site scripting

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

CVE-2021-27308

CVE-2021-27308 concerns 4images v1.8 with a cross-site scripting (XSS) in the admin login panel, exploitable via the redirect parameter. The underlying issue is insufficient input handling on the redirect field, allowing an attacker to inject JavaScript. Documents also reference public exploits/e...

CVE-2021-27308: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

PT-2021-17387 · 4Images · 4Images

Name of the Vulnerable Software and Affected Versions: 4images version 1.8 Description: A cross-site scripting XSS issue exists in the admin login panel, allowing remote attackers to inject JavaScript via the redirect parameter. Recommendations: For 4images version 1.8, consider restricting acces...

Alphaware E-Commerce System 1.0 - Unauthenicated Remote Code Execution Exploit

Exploit Title: Alphaware E-Commerce System 1.0 - Unauthenicated Remote Code Execution File Upload + SQL injection Exploit Author: Christian Vierschilling Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/11676/alphaware-simple-e-commerce-system.html...

CVE-2021-27314

SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page...

CVE-2021-27215

An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces Admin, Userweb, Sidechannel can use different methods to perform the authentication of a user. A specific authentication method during login does not check th...

Sourcecodesterk Doctor Appointment System SQL注入漏洞

Doctor Appointment System is a PHP/MySQLi based doctor appointment system. A SQL injection vulnerability exists in admin.php in Doctor Appointment System 1.0, which can be exploited to insert a malicious SQL query via the username parameter on the login page...

Genua high-resistance-firewall-genugate 访问控制错误漏洞

Genua high-resistance-firewall-genugate is an application from the German company Genua. Provides a network protection feature An Access Control Error vulnerability exists in Genua high-resistance-firewall-genugate, which originates during login, when the authentication method does not check the...

Sql injection

The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user...

CVE-2021-26200

The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user...

CVE-2021-26200

The connected records confirm CVE-2021-26200 affects Library System 1.0, with a SQL injection in the user area that allows bypassing authentication and logging in as admin. The core details: vulnerable component is the user area of Library System 1.0; root cause is SQL injection enabling admin lo...

The vulnerability of the admin/executar_login.php component of the Mk-Auth authentication software allows a hacker to escalate their privileges.

The vulnerability of the admin/executarlogin.php component in the Mk-Auth authentication software is related to errors in managing registration data. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Exploit for OS Command Injection in Sonatype Nexus_Repository_Manager

CVE-2019-5475 CVE-2019-5475 与 CVE-2019-15588 靶场: RCE 命令注入漏洞 ------ 0x00 背景 CVE-2019-5475 是 Nexus 关于内置插件 Yum Repository 的 RCE 命令注入漏洞，其最早被披露于 hackerone，但因官方第一次修复不完整，故又衍生出了 CVE-2019-15588 漏洞。 这两个漏洞都需要以 admin 身份登录后才可以利用，但是 nexus 默认管理员密码 admin123 经常被忽略修改，很容易就被利用了。 0x10 靶场环境 0x20 目录结构 CVE-2019-5475 ├──...

Under Construction < 3.86 - Authenticated Stored Cross-Site Scripting (XSS)

The Underconstruction plugin admin configuration is vulnerable to stored XSS issues which will be triggered in the main page of the site, even when the unfilteredhtml is disabled. Edit WPScanTeam A fix was attempted in v3.80, but was insufficient. In the meantime, more fields were found to be...

PT-2021-11047

Name of the Vulnerable Software and Affected Versions: D-Link DSL-2888A versions prior to AU 2.31 V1.1.47ae55 Description: An issue was discovered where the One Touch application discloses sensitive information. This includes the hashed admin login password and the Internet provider connection...

Raysync Remote Code Execution Vulnerability (CNVD-2020-73753)

Raysync is a cloud platform for storing and transferring large files. A remote code execution vulnerability exists in Raysync versions prior to 3.3.3.8. The vulnerability can be exploited to remotely execute code on a hosted server by sending a specially crafted request to overwrite a specific fi...