CVE-2023-39420

The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the...

Design/Logic Flaw

The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin" account and a corresponding password computed daily by a routine inside the DLL file. Once reverse-engineered, this routine can help an attacker generate the...

CVE-2023-39420

CVE-2023-39420 affects the RDPCore.dll component used in the IRM Next Generation booking engine. The vulnerability arises from a routine that computes a daily password for an admin account, enabling a remote user who can access a customer deployment to gain full, unrestricted access to the applic...

PT-2023-26941 · Unknown · Irm Next Generation

Name of the Vulnerable Software and Affected Versions: IRM Next Generation booking engine affected versions not specified Description: The RDPCore.dll component in the IRM Next Generation booking engine allows a remote user to connect to customers with an "admin" account and a corresponding...

CVE-2023-39512

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability which allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti...

CVE-2023-40918

KnowStreaming 3.3.0 is vulnerable to Escalation of Privileges. Unauthorized users can create a new user with an admin role...

File Upload Vulnerability in Categories

Description I noticed, your website is very secure. But you overlooked a flaw File Upload. Proof of Concept Detail: 1 .Login vs admin demo account and access admin page. 2 .Create a category titled "test" and upload a file image. 3 .Using burp suite edit Content-type: image/html and insert payloa...

Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated) Vulnerability

Exploit Title: Crypto Currency Tracker CCT 9.5 - Admin Account Creation Unauthenticated Exploit Author: 0xBr Software Link: https://codecanyon.net/item/crypto-currency-tracker-prices-charts-news-icos-info-and-more/21588008 Version: =9.5 CVE: CVE-2023-37759 POST /en/user/register HTTP/2 Host:...

Codecanyon Crypto Currency Tracker 安全漏洞

Codecanyon Crypto Currency Tracker is a cryptocurrency tracker from the US company Codecanyon. A security vulnerability exists in Codecanyon Crypto Currency Tracker 9.5 and earlier versions that stems from the ability to create an administrator account without authentication...

Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)

Exploit Title: Crypto Currency Tracker CCT 9.5 - Admin Account Creation Unauthenticated Date: 11.08.2023 Exploit Author: 0xBr Software Link: https://codecanyon.net/item/crypto-currency-tracker-prices-charts-news-icos-info-and-more/21588008 Version: =9.5 CVE: CVE-2023-37759 POST /en/user/register...

Crypto Currency Tracker (CCT) 9.5 Add Administrator

Exploit Title: Crypto Currency Tracker CCT - Admin Account Creation Unauthenticated Date: 11.08.2023 Exploit Author: 0xBr Software Link: https://codecanyon.net/item/crypto-currency-tracker-prices-charts-news-icos-info-and-more/21588008 Version: =9.5 CVE: CVE-2023-37759 POST /en/user/register HTTP...

The vulnerability of the Sitemap plugin in the click5 content management system for WordPress allows a hacker to create an administrator-account and perform a CSRF attack.

The vulnerability of the Sitemap plugin in the click5 content management system for WordPress is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to create an account with administrator privileges and carry out a CSRF attack...

authorized Admin Account Takeover

Description The icms2 contains a flaw in its admin account management functionality, specifically in the process of changing and resetting passwords for administrators. Through careful analysis and testing, it was observed that an authenticated administrator has the capability to change the...

Webutler v3.2 - Remote Code Execution (RCE)

Exploit Title: Webutler v3.2 - Remote Code Execution RCE Application: webutler Cms Version: v3.2 Bugs: RCE Technology: PHP Vendor URL: https://webutler.de/en Software Link: http://webutler.de/download/webutlerv3.2.zip Date of found: 03.08.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technic...

Webutler v3.2 - Remote Code Execution Exploit

Exploit Title: Webutler v3.2 - Remote Code Execution RCE Application: webutler Cms Version: v3.2 Bugs: RCE Technology: PHP Vendor URL: https://webutler.de/en Software Link: http://webutler.de/download/webutlerv3.2.zip Date of found: 03.08.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technic...

CVE-2023-35078

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Recent assessments: cbeek-r7 at July 26, 2024 7:47pm UTC reported: A July 2024 bulletin from multiple U.S. government...

Apache OpenMeetings Web Conferencing Tool Exposed to Critical Vulnerabilities

Multiple security flaws have been disclosed in Apache OpenMeetings, a web conferencing solution, that could be potentially exploited by malicious actors to seize control of admin accounts and run malicious code on susceptible servers. "Attackers can bring the application into an unexpected state,...

CMS Nexin Adminisztracios Kozpont 1.2 Insecure Settings

==================================================================================================================================== | Title : CMS Nexin Adminisztrációs Központ v1.2 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozill...

PimpMyLog 1.7.14 Improper Access Control

Exploit Title: PimpMyLog v1.7.14 - Improper access control Date: 2023-07-10 Exploit Author: thoughtfault Vendor Homepage: https://www.pimpmylog.com/ Software Link: https://github.com/potsky/PimpMyLog Version: 1.5.2-1.7.14 Tested on: Ubuntu 22.04 CVE : N/A Description: PimpMyLog suffers from...

PimpMyLog v1.7.14 - Improper access control Exploit

Exploit Title: PimpMyLog v1.7.14 - Improper access control Exploit Author: thoughtfault Vendor Homepage: https://www.pimpmylog.com/ Software Link: https://github.com/potsky/PimpMyLog Version: 1.5.2-1.7.14 Tested on: Ubuntu 22.04 CVE : N/A Description: PimpMyLog suffers from improper access contro...