Piwigo cross-site scripting vulnerability (CNVD-2018-06555)

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time, and more. A cross-site scripting vulnerability exists in the admin panel in Piwigo version 2.9.3. A remote attacker can exploit th...

Piwigo cross-site scripting vulnerability (CNVD-2018-06554)

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A cross-site scripting vulnerability exists in the admin panel in Piwigo version 2.9.3. A remote attacker can exploit thi...

CVE-2018-7724

CVE-2018-7724 affects Piwigo 2.9.3 and is a stored XSS vulnerability in the admin panel via the name parameter in /admin.php?page=photo-${photo_number}. CSRF may be possible (related to CVE-2017-10681). Affected product/version: Piwigo 2.9.3 (and related entries indicate multi-XSS issues before 2...

Bookly #1 WordPress Booking Plugin Lite Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.Bookly 1 WordPress Booking Plugin Lite is a lite version of the schedule management plugin used in... A cross-site...

CVE-2018-6883

Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator...

CVE-2018-6883

Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator...

CVE-2018-6883

Piwigo before 2.9.3 is affected by a SQL injection in admin/tags.php via the tags array parameter in admin.php?page=tags; the attacker must be an administrator. The issue is triggered in the administration panel, and CVE-2018-6883 is documented with CVSS metrics (2.0/4.0 base, 3.0/4.9 base) indic...

Magento CMS Admin Panel Remote Code Execution Vulnerability

Magento CMS is the United States Magento company's set of open source PHP e-commerce content management system CMS. A remote code execution vulnerability exists in the Magento CMS administration panel. An attacker can exploit the vulnerability to execute arbitrary code in the affected application...

WordPress Bookly Lite 13.2 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications In January I found a stored XSS in Bookly WP Plugin 10,000+ download for Lite version on official WordPress plugin site and 18,000+ for Pro version on CodeCanyon. Link of Bookly stored XSS proof-of-concept:...

PT-2018-4010 · D Link · D-Link Dir-600M C1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-600M C1 version 3.01 Description: The issue exists due to inadequate protection of the web page structure in the administrative panel of the D-Link DIR-600M C1 Wi-Fi router's firmware. This allows a remote attacker to conduct a...

WordPress Bookly Lite 13.2 Cross Site Scripting

In January I found a stored XSS in Bookly WP Plugin 10,000+ download for Lite version on official WordPress plugin site and 18,000+ for Pro version on CodeCanyon. Link of Bookly stored XSS proof-of-concept: https://www.gubello.me/blog/bookly-blind-stored-xss/ During the booking phase, an...

Bookly #1 WordPress Booking Plugin (Lite) <= 13.2 – Unauthenticated Blind Stored XSS

An unauthenticated user can inject arbitrary persistent javascript code in the admin panel via Bookly plug-in...

Zomato: Blind XSS - Report review - Admin panel

Introduction In the Zomato Business app there is the functionality to report a review and give additional details as to why you did report the review. Because I knew this reason would be read by Zomato admins I did insert a blind XSS payload here, which ended up executing on...

WordPress flickrRSS plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers. flickrRSS plugin is used in one of the plugin to display images. A cross-site scripting vulnerability exists in th...

Student Profile Management System Script 2.0.6 - Admin Panel Authentication Bypass Vulnerability

With this exploit,Attacker can bypass admin panel Authentication. Exploit title: Student Profile Management System Script 2.0.6 - Admin Panel Authentication Bypass Dork: "Powered by: i-Net Solution" Date: 2018-02-06 Exploit Author: Borna nematzadeh L0RD or email protected Vendor Homepage:...

Student Profile Management System Script 2.0.6 SQL Injection

Exploit title: Student Profile Management System Script 2.0.6 - Admin Panel Authentication Bypass Dork: "Powered by: i-Net Solution" Date: 2018-02-06 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage:...

Student Profile Management System Script 2.0.6 - Authentication Bypass

Student Profile Management System Script 2.0.6 - Authentication Bypass Exploit title: Student Profile Management System Script 2.0.6 - Admin Panel Authentication Bypass Dork: "Powered by: i-Net Solution" Date: 2018-02-06 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendo...

Student Profile Management System Script 2.0.6 - Authentication Bypass

Exploit title: Student Profile Management System Script 2.0.6 - Admin Panel Authentication Bypass Dork: "Powered by: i-Net Solution" Date: 2018-02-06 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage:...

CVE-2017-17108

Path traversal vulnerability in the administrative panel in KonaKart eCommerce Platform version 8.7 and earlier could allow an attacker to download system files, as well as upload specially crafted JSP files and in turn gain access to the server...

Asus Router Cross Site Script / Authentication Bypass

In the name of god ------------------------- Exploit Title : -------------------- Asus Routers DSL-RT-N13 , DSL-N14U B1 Vulnerability Exploit Author : --------------------- 4TT4CK3R Category : --------------------- Remote and Local Home Page : --------------------- https://asus.com Google Dork :...