CVE-2018-8755

The CVE-2018-8755 issue affects NuCom NC-WR644GACV routers with firmware STA 005 and earlier, where an unauthenticated attacker can download the device configuration file, exposing admin credentials, WPA keys, and other config data. Root cause is an authentication/authorization bypass that allows...

AsusWRT #RTAC750GF - Cross-Site Request Forgery (Change Admin Password) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: AsusWRT RT-AC750GF - Cross-Site Request Forgery Change Admin Password Exploit Author: Wadeek Vendor Homepage: https://www.asus.com/ Firmware Link:...

AsusWRT RT-AC750GF - Cross-Site Request Forgery (Change Admin Password)

AsusWRT RT-AC750GF - Cross-Site Request Forgery Change Admin Password Exploit Title: AsusWRT RT-AC750GF - Cross-Site Request Forgery Change Admin Password Date: 2018-06-23 Exploit Author: Wadeek Vendor Homepage: https://www.asus.com/ Firmware Link:...

AsusWRT RT-AC750GF - Cross-Site Request Forgery (Change Admin Password)

Exploit Title: AsusWRT RT-AC750GF - Cross-Site Request Forgery Change Admin Password Date: 2018-06-23 Exploit Author: Wadeek Vendor Homepage: https://www.asus.com/ Firmware Link: http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC750GF/FWRTAC750GF30043806038.zip Firmware Version: 3.0.0.4.380.6038...

AsusWRT RT-AC750GF Cross Site Request Forgery

Exploit Title: AsusWRT RT-AC750GF - Cross-Site Request Forgery Change Admin Password Date: 2018-06-23 Exploit Author: Wadeek Vendor Homepage: https://www.asus.com/ Firmware Link: http://dlcdnet.asus.com/pub/ASUS/wireless/RT-AC750GF/FWRTAC750GF30043806038.zip Firmware Version: 3.0.0.4.380.6038...

CVE-2018-12073

An issue was discovered on Eminent EM4544 9.10 devices. The device does not require the user's current password to set a new one within the web interface. Therefore, it is possible to exploit this issue e.g., in combination with a successful XSS, or at an unattended workstation to change the admi...

Design/Logic Flaw

An issue was discovered on Eminent EM4544 9.10 devices. The device does not require the user's current password to set a new one within the web interface. Therefore, it is possible to exploit this issue e.g., in combination with a successful XSS, or at an unattended workstation to change the admi...

CVE-2018-12073

An issue was discovered on Eminent EM4544 9.10 devices. The device does not require the user's current password to set a new one within the web interface. Therefore, it is possible to exploit this issue e.g., in combination with a successful XSS, or at an unattended workstation to change the admi...

Intelligent Baseboard Management Controller elevation of privilege vulnerability in multiple Huawei products (CNVD-2018-11504)

Huawei 1288H V5 and others are different models of server equipment from Huawei, China.Intelligent Baseboard Management Controller iBMC is one of the embedded server intelligent management system. A security vulnerability exists in iBMC in several Huawei products, which stems from the program...

Smartshop 1 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: Smartshop 1 - Cross site request forgery Exploit Author: L0RD or email protected Software Link: https://github.com/smakosh/Smartshop/archive/master.zip Vendor Homepage:...

Smartshop 1 - Cross-Site Request Forgery

Smartshop 1 - Cross-Site Request Forgery Exploit Title: Smartshop 1 - Cross site request forgery Date: 2018-06-02 Exploit Author: L0RD or [email protected] Software Link: https://github.com/smakosh/Smartshop/archive/master.zip Vendor Homepage:...

Smartshop 1 Cross Site Request Forgery

Exploit Title: Smartshop 1 - Cross site request forgery Date: 2018-06-02 Exploit Author: L0RD or [email protected] Software Link: https://github.com/smakosh/Smartshop/archive/master.zip Vendor Homepage: https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website Version...

Smartshop 1 - Cross-Site Request Forgery

Exploit Title: Smartshop 1 - Cross site request forgery Date: 2018-06-02 Exploit Author: L0RD or [email protected] Software Link: https://github.com/smakosh/Smartshop/archive/master.zip Vendor Homepage: https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website Version...

CVE-2018-7950

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to...

Input validation

The iBMC Intelligent Baseboard Management Controller of some Huawei servers have a JSON injection vulnerability due to insufficient input validation. An authenticated, remote attacker can launch a JSON injection to modify the password of administrator. Successful exploit may allow attackers to...

CVE-2018-7951

The CVE-2018-7951 issue affects the iBMC of some Huawei servers. It arises from insufficient input validation and enables an authenticated, remote attacker to perform a JSON injection that can change the administrator password, potentially granting system management privileges. The Huawei advisor...

PHPMyWind 5.5前台存在sql注入，可重置管理员密码

...

D-Link DIR-815 Information Disclosure Vulnerability

D-Link DIR-815 is a wireless router product from AUO D-Link. An information disclosure vulnerability exists in the D-Link DIR-815 with firmware prior to version 2.07.B01, which originates from the program storing the administrative password in plaintext. A remote attacker could exploit this...

CVE-2018-11527

An issue was discovered in CScms v4.1. A Cross-site request forgery CSRF vulnerability in plugins/sys/admin/Sys.php allows remote attackers to change the administrator's username and password via /admin.php/sys/editpasssave...

Huawei 1288H V5 and 2288H V5 JSON Injection Vulnerability (CNVD-2018-10504)

The Huawei 1288H V5 and 2288H V5 are both rackmount server units from Huawei, a Chinese company. A security vulnerability exists in Huawei 1288H V5 and 2288H V5 version V100R005C00, which originates from the program failing to adequately validate input. A remote attacker can exploit the...