1462 matches found
Cross site scripting
Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the realname or emailaddress field to themes/CleanFS/templates/common.editallusers.tpl...
CVE-2017-6775
A vulnerability in the CLI of Cisco ASR 5000 Series Aggregated Services Routers running the Cisco StarOS operating system could allow an authenticated, local attacker to elevate their privileges to admin-level privileges. The vulnerability is due to incorrect permissions that are given to a set o...
ClipBucket 2.8.3 - Multiple Vulnerabilities
Exploit for php platform in category web applications @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ .:. Exploit Title ClipBucket 2.8.3 - Multiple Vulnerabilities .:. Google Dorks .:. "Forged by ClipBucket" inurl:viewcollection.php?cid= .:. Date: August 15,...
Input validation
Intense PC Phoenix SecureCore UEFI firmware does not perform capsule signature validation before upgrading the system firmware. The absence of signature validation allows an attacker with administrator privileges to flash a modified UEFI BIOS...
Code injection
An attacker is logged in as a normal user and can somehow make admin to delete shared folders in ownCloud Server before 10.0.2...
Easy File Sharing Web Server 7.2 - Unrestricted File Upload
Easy File Sharing Web Server 7.2 - Unrestricted File Upload 2017/6/15 Chako EFS Web Server 7.2 Unrestricted File Upload Vendor Homepage: http://www.sharing-file.com Software Link: https://www.exploit-db.com/apps/60f3ff1f3cd34dec80fba130ea481f31-efssetup.exe Version: Easy File Sharing Web Server 7...
CVE-2017-9836
CVE-2017-9836 affects Piwigo 2.9.1 with stored XSS via the virtual_name parameter in /admin.php (creating a virtual album). The issue requires an authenticated administrator to trigger the payload, allowing injection of arbitrary web script or HTML. The connected sources confirm the vulnerability...
CVE-2017-9759
SQL Injection exists in admin/index.php in Zenbership 1.0.8 via the filters array parameter, exploitable by a privileged account...
NetGain EM 7.2.647 build 941 - Authentication Bypass Local File Inclusion
NetGain EM 7.2.647 build 941 - Authentication Bypass Local File Inclusion ''' Exploit Title: Add User Account with Admin Privilege without Login & Local File Inclusion Date: 2017-05-21 Exploit Author: f3ci Vendor Homepage: http://www.netgain-systems.com Software Link:...
NetGain EM 7.2.647 build 941 - Authentication Bypass / Local File Inclusion
''' Exploit Title: Add User Account with Admin Privilege without Login & Local File Inclusion Date: 2017-05-21 Exploit Author: f3ci Vendor Homepage: http://www.netgain-systems.com Software Link: http://www.netgain-systems.com/free-edition-download/ Version: = v7.2.647 build 941 Tested on: Windows...
NetGain EM 7.2.647 build 941 - Authentication Bypass / Local File Inclusion Vulnerabilities
Exploit for jsp platform in category web applications ''' Exploit Title: Add User Account with Admin Privilege without Login & Local File Inclusion Date: 2017-05-21 Exploit Author: f3ci Vendor Homepage: http://www.netgain-systems.com Software Link:...
FortiWLC-SD Privilege escalation vulnerability using copy running-config
The lack of input sanitisation for CLI command 'copy running-config' allows a user with 'admin' or 'superuser' privilege level to gain shell on the FortiWLC-SD with root privilege...
CVE-2017-7571
public/rolechangeadmin in Faveo 1.9.3 allows CSRF. The impact is obtaining admin privileges...
HelpDEZK 1.1.1 - Cross-Site Request Forgery / Code Execution Vulnerabilities
Exploit for php platform in category web applications Exploit Title: Multiple CSRF Remote Code Execution Vulnerability on HelpDEZK 1.1.1 Date: 05-April-2017 Exploit Author: @runggareksya, @yokoacc, @AdyWikradinata, @dickysofficial, @dvnrcy Vendor Homepage: http://www.helpdezk.org/ Software Link:...
Privilege escalation
Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Base64-encoded session cookie value...
CVE-2016-9333
CVE-2016-9333 affects Moxa SoftCMS prior to version 1.6. The SoftCMS Webserver fails to properly sanitize input, enabling SQL Injection that could allow a remote attacker to gain administrator privileges. The vulnerability has been assigned CVSS v3 base score 9.8 (CRITICAL) with network access, n...
Alstrasoft FMyLife Pro 1.02 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications Exploit Title: AlstraSoft FMyLife Pro v1.02 Script - Cross-Site Request Forgery Add Admin Google Dork: N/A Date: 04.02.2017 Vendor Homepage: http://www.alstrasoft.com/ Software Buy: http://www.alstrasoft.com/fmylife-pro.htm Demo:...
e107 CMS-2.1.1 privilege elevation vulnerability
No description provided by source. $login, 'userpass' = $pass, 'userlogin' = 'Sign In'; curlsetopt$ch, CURLOPTPOST, 1; $content = curlexec$ch; if strpos$content, '?logout' === false die"Cannot login"; $data = array; $data'useradmin' = 1; $data'userperms' = 0; $data'userpassword' = md5$pass;...
Event Calender PHP Cross-Site Request Forgery Vulnerability
Event Calendar is an event calendar module for phpnuke. A cross-site request forgery vulnerability exists in the admin.php page of Event Calendar PHP version 1.5, which can be exploited by an attacker to add an administrator account or elevate privileges to an administrator account...