5009 matches found
CVE-2017-11194
Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. In the admin panel, the certid parameter of adminservercacertdetails.cgi is reflected in the application's response and is not properly sanitized, allowing an attacker to inject tags. An attacker could come up with clev...
CVE-2017-11196
Pulse Connect Secure 8.3R1 has CSRF in logout.cgi. The logout function of the admin panel is not protected by any CSRF tokens, thus allowing an attacker to logout a user by making them visit a malicious web page...
CVE-2017-11196
Pulse Connect Secure 8.3R1 is affected by a Cross-Site Request Forgery in logout.cgi. The admin panel logout is not protected by CSRF tokens, allowing an attacker to log out a user by enticing them to visit a malicious page. Connected documents confirm the issue and note remediation through softw...
U.S. Dept Of Defense: Admin Salt Leakage on DoD site.
Hi there, the login page located at https://█████████/████████/adminapi/administrator.cfc is leaking administrator salt which is required at authentication purpose. PoC: Navigate to https://████/████████/adminapi/administrator.cfc?method=getSalt which will show you the admin salt ████████ which i...
Xavier SQL Injection Vulnerability
Xavier - PHP is a login script and user management administration panel. Xavier suffers from a SQL injection vulnerability. Allows attackers to exploit the vulnerability to obtain sensitive information...
Xavier 2.4 - SQL Injection
Xavier 2.4 - SQL Injection Document Title: =============== Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2076 Release Date: ============= 2017-06-06 Vulnerability Laboratory ID VL-ID:...
CVE-2017-9452
Cross-site scripting XSS vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the page parameter...
Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities
Document Title: =============== Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2076 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15949 CVE-ID: ======= CVE-2017-15949 Release Date:...
Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities
Document Title: =============== Xavier v2.4 PHP MP - SQL Injection Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2076 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15949 CVE-ID: ======= CVE-2017-15949 Release Date:...
CMS Web-Gooroo 1.141 - Multiple Vulnerabilities
CMS Web-Gooroo 1.141 - Multiple Vulnerabilities Exploit Title: CMS Web-Gooroo getmegaadmin; 2d626704807d4c5be1b46e85c4070fec - mayhem 2967a371178d713d3898957dd44786af - no success in bruteforce, though... 3. Full path disclosure Almost any file, because of lack of input validation and overall bad...
Shopify: XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applications
Description Shopify allows developers to create a special type of application called a "Sales Channel". Developers are allowed to upload a 16x16 SVG "Navigation Icon" for their app provided the SVG follows the design guidelines which limits the allowed elements and attributes. For some reason whe...
CMS Made Simple 2.1.6 - Multiple Vulnerabilities
CMS Made Simple 2.1.6 - Multiple Vulnerabilities Title: CMSMS 2.1.6 Multiple Vulnerabilities Date: 10-05-2017 Tested on: Windows 8 64-bit Exploit Author: Osanda Malith Jayathissa @OsandaMalith Original write-up: https://osandamalith.com/2017/05/11/cmsms-2-1-6-multiple-vulnerabilities/ CVE:...
CVE-2016-2104
This CVE relates to multiple XSS vulnerabilities in Red Hat Satellite 5 (Spacewalk) where an attacker can inject arbitrary script/HTML via parameters such as label, package_name, search_subscribed_channels, channel_filter, or vectors like input:hidden /bean:message . The issue is documented acros...
SQL injection vulnerability in the uid parameter in the admin_members.php page of the Ocean CMS website builder system
Ocean CMS is an open source website builder. A SQL injection vulnerability exists in the /admin/adminmembers.php page of the Ocean CMS system. The lack of filtering of the "uid" parameter allows attackers to exploit the vulnerability to obtain sensitive database information...
ICMusic CMS 1.x SQL Injection
Title: ICMusic CMS v1.x - Authentication Bypass Credit: Bilal KARDADOU Vendor: http://www.icloudcenter.com Vendor URL: http://www.icloudcenter.com/music-site-script.htm Product: ICMusic CMS v1.x Google Dork: N/A Product & Service Introduction: "ICMusic" is a music directory site script, ready for...
Freelancer Script 4.0.1 SQL Injection
Title: FREELANCER SCRIPT v4.0.1 - Authentication Bypass & SQL injection Credit: Bilal KARDADOU Vendor: http://www.2daybiz.com Vendor URL: http://2daybiz.com/content/products/products/job-site-script/119-freelancer-script.php Product: FREELANCER SCRIPT v4.0.1 Google Dork: N/A Product & Service...
CVE-2017-6446
XSS was discovered in Dotclear v2.11.2, affecting admin/blogs.php and admin/users.php with the sortby and order parameters...
bpsdm.pu.go.id XSS vulnerability
Vulnerable URL: http://bpsdm.pu.go.id/karir/admin/manage?statusverifikasi=all=testprompt/OPENBUGBOUNTY/...
