CVE-2021-24189

Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Captchinoo, Google recaptcha for admin login page WordPress plugin before 2.4, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then...

Dental Clinic Appointment Reservation System 1.0 - Authentication Bypass (SQLi)

Exploit Title: Dental Clinic Appointment Reservation System 1.0 - Authentication Bypass SQLi Date: 12.05.2021 Exploit Author: Mesut Cetin Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html Software Link:...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. The WordPress plugin Business Directory prior to version 5.11 suffers from a cross-site request...

Tenda D151 & D301 - Configuration Download (Unauthenticated) Exploit

Exploit Title: Tenda D151 & D301 - Configuration Download Unauthenticated Exploit Author: BenChaliah Author link: https://github.com/BenChaliah Vendor Homepage: https://www.tendacn.com Software Link: https://www.tendacn.com/us/download/detail-3331.html Versions: - D301 1.2.11.2EN - D301 V2.0...

CVE-2021-29439

The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission admin.login can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obtain an arbitrary code execution primitiv...

PT-2021-18215 · Grav · Grav Admin Plugin

Name of the Vulnerable Software and Affected Versions: Grav admin plugin versions prior to 1.10.11 Description: The issue arises from incorrect verification of caller's privileges, allowing users with the admin.login permission to install third-party plugins and their dependencies. This can lead ...

Basic Shopping Cart 1.0 SQL Injection

Exploit Title: Basic Shopping Cart 1.0 - Authentication Bypass Date: 2021-04-03 Exploit Author: Viren Saroha illusion Vendor Homepage: https://www.sourcecodester.com/php/10964/basic-shopping-cartphpmysql.html Software Link:...

Basic Shopping Cart 1.0 - Authentication Bypass

Exploit Title: Basic Shopping Cart 1.0 - Authentication Bypass Date: 2021-04-03 Exploit Author: Viren Saroha illusion Vendor Homepage: https://www.sourcecodester.com/php/10964/basic-shopping-cartphpmysql.html Software Link:...

WSO2 Management Console 跨站脚本漏洞

WSO2 Management Console is an application from WSO2 USA, Inc. A management console. A cross-site scripting vulnerability exists in WSO2 Management Console through 5.10 that allows XSS via the carbon admin login.jsp msgId parameter...

Basic Shopping Cart 1.0 - Authentication Bypass Vulnerability

Exploit Title: Basic Shopping Cart 1.0 - Authentication Bypass Exploit Author: Viren Saroha illusion Vendor Homepage: https://www.sourcecodester.com/php/10964/basic-shopping-cartphpmysql.html Software Link:...

Sourcecodester Simple College Website SQL注入漏洞

Sourcecodester Simple College Website is a content management system from Sourcecodester. Sourcecodester Simple College Website suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in database-based applications, which can be exploit...

Exploit for Cross-site Scripting in Get-Simple Getsimple_Cms

CVE-2020-23839 | GetSimple CMS v3.3.16 - Reflected XSS to RCE...

GetSimple CMS 3.3.16 - Reflected XSS to RCE Exploit

Exploit Title: GetSimple CMS 3.3.16 - Reflected XSS to RCE Exploit Author: Bobby Cooke boku Discovery Credits: Bobby Cooke boku & Adeeb Shah @hyd3sec CVE ID: CVE-2020-23839 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23839 Vendor Homepage: http://get-simple.info Software Link:...

GetSimple CMS 3.3.16 Cross Site Scripting / Shell Upload

Exploit Title: GetSimple CMS 3.3.16 - Reflected XSS to RCE Exploit Author: Bobby Cooke boku Discovery Credits: Bobby Cooke boku & Adeeb Shah @hyd3sec Date: March 29th, 2021 CVE ID: CVE-2020-23839 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-23839 Vendor Homepage: http://get-simple.in...

Health Center Patient Record Management System 1.0 SQL Injection Vulnerability

Exploit Title: Health Center Patient Record Management System | Admin Login Bypass SQLi Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/php/11058/health-center-patient-record-management-system.html Software Link:...

CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

Cross site scripting

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

CVE-2021-27308

CVE-2021-27308 concerns 4images v1.8 with a cross-site scripting (XSS) in the admin login panel, exploitable via the redirect parameter. The underlying issue is insufficient input handling on the redirect field, allowing an attacker to inject JavaScript. Documents also reference public exploits/e...