Unspecified Vulnerability in Wyse ThinOS

Wyse ThinOS is a specialized operating system for Dell servers from Dell USA. A security vulnerability exists in Wyse ThinOS that stems from the inclusion of a regular expression denial of service vulnerability in the UI, which can be exploited by an administrator privileged attacker to cause a...

Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck

CVE-2020-29607-Exploit Exploit Title: Pluck CMS 4.7.13 - F...

Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck

CVE-2020-29607-Exploit Exploit Title: Pluck CMS 4.7.13 - F...

CVE-2021-24138

Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user...

PT-2021-15683

Name of the Vulnerable Software and Affected Versions: AdRotate WordPress plugin versions prior to 5.8.4 Description: The issue is related to unvalidated input in the AdRotate WordPress plugin, which leads to authenticated SQL injection. This can be achieved via the id parameter and requires an...

CVE-2021-24138: Improper Neutralization of Special Elements used in an SQL Command

Unvalidated input in the AdRotate WordPress plugin, versions before 5.8.4, leads to Authenticated SQL injection via param "id". This requires an admin privileged user...

CVE-2020-29607

CVE-2020-29607 affects Pluck CMS prior to 4.7.13, where a file upload restriction bypass in the admin “manage files” functionality allows an authenticated admin to upload a payload and trigger remote code execution. Public references show an authenticated file-upload RCE exploit for Pluck 4.7.13 ...

CVE-2020-29607: Unrestricted Upload of File with Dangerous Type

A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution...

AdRotate < 5.8.4 - Authenticated SQL Injection

Authenticated SQL injection in the AdRotate 5.8.3.1 exists via param "id". However, this requires an admin privileged user. NOTE: The plugin author mistook this SQLi bug for XSS but the remedy remains OK. PoC Param "id" is vulneable to SQL Injeciton. Example 1:...