CVE-2020-15408

Pulse Connect Secure (PCS) before 9.1R8 is affected by CVE-2020-15408. An authenticated attacker can access the admin page console via the end-user web interface due to a rewrite. This is documented in multiple sources (NVD/NIST entry and Pulse advisory SA44516). The issue’s impact is limited to ...

CVE-2020-15408

An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web interface because of a rewrite. Recent assessments: wvu-r7 at July 28, 2020 6:20pm UTC reported: I wonder if this has SSRF-to-RCE potential...

Apache Airflow RBAC Admin Page Cross-Site Scripting Vulnerability

Apache Airflow is the United States Apache Apache Software Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A cross-site scripting vulnerability exists in the RBAC Admin page in Apac...

Findus - Directory Listing < 1.1.15 - Authenticated Persistent XSS

Authenticated Persistent XSS vulnerability was discovered in the «Findus - Directory Listing WordPress Theme», tested version — v1.1.14. Injected payload will trigger in the admin dashboard, in the «My listings» page and on listing page itself. POST /submit-listing/ HTTP/1.1 Host: example.com...

FortiMail Unauthenticated Login Bypass Scanner

This module attempts to detect instances of FortiMail vulnerable against an unauthenticated login bypass CVE-2020-9294. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'FortiMail Unauthenticated...

Design/Logic Flaw

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...

UBUNTU-CVE-2020-4049

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

CVE-2020-4049

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

Online Course Registration 1.0 - Authentication Bypass

Exploit Title: Online Course Registration 1.0 - Authentication Bypass Google Dork: N/A Date: 2020-06-05 Exploit Author: BKpatron Vendor Homepage: https://www.sourcecodester.com/php/14251/online-course-registration.html Software Link:...

CVE-2014-8945

admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields...

Command injection

admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields...

CVE-2014-8941

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&fromid= or admin.php?page=history&limit= URI...

Shopify: xss stored in https://your store.myshopify.com/admin/

hello , i fond xss stored in https://your store.myshopify.com/admin/ steps ; 1. go to https://swqdewd.myshopify.com/admin/menus/new 2. click in Add menu item 3. add name " AND any link 4. now click add 5. click in remove item 6. alert 7. watch the vedio poc for more information Impact xss attack...

WordPress bbPress plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. bbPress is a forum plugin used in it. A cross-site scripting vulnerability exists in WordPress bbPress plugin 2.6.4 and...

Command execution vulnerability in SeaCMS backend ad***_pi***.php page

SeaCMS is a station building system based on PHP+MYSQL architecture and supports cross-platform operation. A command execution vulnerability exists in the adpi.php page in the background of SeaCMS. An attacker can exploit the vulnerability to gain control of the server...

CommScope Ruckus ZoneFlex R500 Cross-Site Request Forgery Vulnerability

CommScope Ruckus ZoneFlex R500 is a wireless access point product from CommScope, Inc. A cross-site request forgery vulnerability exists in the login.asp page in the CommScope Ruckus ZoneFlex R500. An attacker could exploit this vulnerability to perform a crawl or other analysis with the SUBCA-1...

WordPress WTI Like Post Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wti-like-post is a plugin used to add likes to web pages. A cross-site scripting vulnerability exists in the administration page of...

CVE-2020-8799

A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website...

CVE-2020-8799

A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website...

Online Course Registration 2.0 SQL Injection

Exploit Title: Online Course Registration 2.0 - Authentication Bypass Google Dork: N/A Date: 2020-04-25 Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-course-registration-free-download/ Version: 2.0 Tested on: Kali Linux...