CSP MySQL User Manager 2.3.1 SQL Injection

Exploit Title: CSP MySQL User Manager v2.3.1 SQL Injection Authentication Bypass Google Dork: intitle:"CSP MySQL User Manager" Date: 04/05/2018 Exploit Author: Youssef mami Vendor Homepage: https://code.google.com/archive/p/cspmum/ Software Link:...

akam-hotel.com XSS vulnerability

Open Bug Bounty ID: OBB-611371 Description| Value ---|--- Affected Website:| akam-hotel.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

marasem.ir XSS vulnerability

Open Bug Bounty ID: OBB-611363 Description| Value ---|--- Affected Website:| marasem.ir Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

joopar.com XSS vulnerability

Open Bug Bounty ID: OBB-611362 Description| Value ---|--- Affected Website:| joopar.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

skridsko.net XSS vulnerability

Open Bug Bounty ID: OBB-610730 Description| Value ---|--- Affected Website:| skridsko.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

lowther-holidaypark.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-598385 Description| Value ---|--- Affected Website:| lowther-holidaypark.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Razer US: Admin login page reveals user account - no anti-bruteforce

A login page's text upon a failed login could have been used to determine valid user names. The text was adjusted to avoid this...

kmrc.in XSS vulnerability

Open Bug Bounty ID: OBB-578803 Description| Value ---|--- Affected Website:| kmrc.in Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Default credentials

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

CVE-2018-7581

\ProgramData\WebLog Expert\WebServer\WebServer.cfg in WebLog Expert Web Server Enterprise 9.4 has weak permissions BUILTIN\Users:IDC, which allows local users to set a cleartext password and login as admin...

WebLog Expert Web Server Enterprise 9.4 Weak Permissions Vulnerability

Exploit for windows platform in category local exploits + Credits: John Page aka hyp3rlinx Vendor: ======== www.weblogexpert.com Product: ======== WebLog Expert Web Server Enterprise v9.4 WebLog Expert is a fast and powerful access log analyzer. It will give you information about your site's...

medienhaus-brandenburger.de XSS vulnerability

Open Bug Bounty ID: OBB-567689 Description| Value ---|--- Affected Website:| medienhaus-brandenburger.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

planetoftheweb.com XSS vulnerability

Open Bug Bounty ID: OBB-566611 Description| Value ---|--- Affected Website:| planetoftheweb.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Social Oauth Login PHP - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Social Oauth Login PHP - Authentication Bypass Dork: N/A Exploit Author: Borna nematzadeh L0RD or email protected Vendor Homepage: https://www.codester.com/items/4554/social-oauth-login-php Version: All version Category: Webapps...

TrendNet AUTHORIZED_GROUP Information Disclosure Vulnerability

Exploit for hardware platform in category web applications TrendNet AUTHORIZEDGROUP Information Disclosure Full report: https://blogs.securiteam.com/index.php/archives/3627 Twitter: @SecuriTeamSSD Weibo: SecuriTeamSSD Vulnerability Summary The following advisory describes an information disclosur...

Joomla! Administration Panel Login Form Detected

Joomla! Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...

CVE-2018-5705

Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine the t parameter to the /search URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By sending users an infected URL, code will ...

Vulnerabilities in DM Enterprise Building System's common.inc2010.php file with out-of-rights access

DM enterprise building system is developed by php + mysql a set of specialized in small and medium-sized enterprise website construction of open source cms. DM enterprise website builder system common.inc2010.php file has an override access vulnerability. Attackers can use the vulnerability to...

CVE-2017-17947

A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure PCS before 8.0R17.0, 8.1.x before 8.1R13, 8.2.x before 8.2R9, and 8.3.x before 8.3R3 and Pulse Policy Secure PPS before 5.2R10, 5.3.x before 5.3R9, and 5.4.x before 5.4R3 due to one of the URL...

CVE-2018-5479

FoxSash ImgHosting 1.5 according to footer information is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admins. By...