CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

PT-2021-17387 · 4Images · 4Images

Name of the Vulnerable Software and Affected Versions: 4images version 1.8 Description: A cross-site scripting XSS issue exists in the admin login panel, allowing remote attackers to inject JavaScript via the redirect parameter. Recommendations: For 4images version 1.8, consider restricting acces...

Alphaware E-Commerce System 1.0 - Unauthenicated Remote Code Execution Exploit

Exploit Title: Alphaware E-Commerce System 1.0 - Unauthenicated Remote Code Execution File Upload + SQL injection Exploit Author: Christian Vierschilling Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/11676/alphaware-simple-e-commerce-system.html...

CVE-2021-27215

An issue was discovered in genua genugate before 9.0 Z p19, 9.1.x through 9.6.x before 9.6 p7, and 10.x before 10.1 p4. The Web Interfaces Admin, Userweb, Sidechannel can use different methods to perform the authentication of a user. A specific authentication method during login does not check th...

Sourcecodesterk Doctor Appointment System SQL注入漏洞

Doctor Appointment System is a PHP/MySQLi based doctor appointment system. A SQL injection vulnerability exists in admin.php in Doctor Appointment System 1.0, which can be exploited to insert a malicious SQL query via the username parameter on the login page...

Genua high-resistance-firewall-genugate 访问控制错误漏洞

Genua high-resistance-firewall-genugate is an application from the German company Genua. Provides a network protection feature An Access Control Error vulnerability exists in Genua high-resistance-firewall-genugate, which originates during login, when the authentication method does not check the...

Sql injection

The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user...

CVE-2021-26200

The connected records confirm CVE-2021-26200 affects Library System 1.0, with a SQL injection in the user area that allows bypassing authentication and logging in as admin. The core details: vulnerable component is the user area of Library System 1.0; root cause is SQL injection enabling admin lo...

The vulnerability of the admin/executar_login.php component of the Mk-Auth authentication software allows a hacker to escalate their privileges.

The vulnerability of the admin/executarlogin.php component in the Mk-Auth authentication software is related to errors in managing registration data. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Exploit for OS Command Injection in Sonatype Nexus_Repository_Manager

CVE-2019-5475 CVE-2019-5475 与 CVE-2019-15588 靶场: RCE 命令注入漏洞 ------ 0x00 背景 CVE-2019-5475 是 Nexus 关于内置插件 Yum Repository 的 RCE 命令注入漏洞，其最早被披露于 hackerone，但因官方第一次修复不完整，故又衍生出了 CVE-2019-15588 漏洞。 这两个漏洞都需要以 admin 身份登录后才可以利用，但是 nexus 默认管理员密码 admin123 经常被忽略修改，很容易就被利用了。 0x10 靶场环境 0x20 目录结构 CVE-2019-5475 ├──...

Under Construction < 3.86 - Authenticated Stored Cross-Site Scripting (XSS)

The Underconstruction plugin admin configuration is vulnerable to stored XSS issues which will be triggered in the main page of the site, even when the unfilteredhtml is disabled. Edit WPScanTeam A fix was attempted in v3.80, but was insufficient. In the meantime, more fields were found to be...

Raysync Remote Code Execution Vulnerability (CNVD-2020-73753)

Raysync is a cloud platform for storing and transferring large files. A remote code execution vulnerability exists in Raysync versions prior to 3.3.3.8. The vulnerability can be exploited to remotely execute code on a hosted server by sending a specially crafted request to overwrite a specific fi...

CVE-2020-35370

A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code executionRCE on the...

CVE-2020-35370

A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code executionRCE on the...

Design/Logic Flaw

A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as "admin", then to modify specific shell file to achieve remote code executionRCE on the...

Raysync 代码注入漏洞

Raysync is a cloud platform for storing and transferring large files. A remote code execution vulnerability exists in Raysync versions prior to 3.3.3.8. The vulnerability can be exploited to remotely execute code on a hosted server by sending a specially crafted request to overwrite a specific fi...

CVE-2020-29583

Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...

Egavilanmedia ECM Address Book SQL Injection Vulnerability

Egavilanmedia ECM Address Book is a platform for organizing and identifying address books from Egavilanmedia, USA. An SQL injection vulnerability exists in EgavilanMedia ECM Address Book 1.0, which can be exploited to bypass the administrative login panel via SQLi, gain administrative access, and...

CVE-2020-35276

EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user...

Egavilanmedia ECM Address Book SQL注入漏洞

Egavilanmedia ECM Address Book is a platform for organizing and identifying address books from Egavilanmedia, USA. An SQL injection vulnerability exists in EgavilanMedia ECM Address Book 1.0, which can be exploited to bypass the administrative login panel via SQLi, gain administrative access, and...