15 matches found
CVE-2026-27886: Improper Limitation of a Pathname to a Restricted Directory
Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the where query parameter on any publicly-accessibl...
CVE-2026-6667: Missing Authorization
PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILLCLIENT admin command. All users with access to the administration console which itself requires authorization could run this command. It would have been correct to allow only users listed in the adminusers...
Moderate: Red Hat Security Advisory: ansible security and bug fix update
An update for ansible is now available for Red Hat Ansible Engine 2.5 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Moderate: Red Hat Security Advisory: ansible security and bug fix update
An update for ansible is now available for Red Hat Ansible Engine 2 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
Vastal I-Tech SQL Injection
IN THE NAME OF GOD Vastal I-Tech SQL Injection Vulnerability Author : HELLBOY Tested on Lunix CVE : N/A Email : [email protected] Dork : inurl:"viewgroup.php?groupid=" Exploit : http://site/viewgroup.php?groupid=SQLI EXAM:...
CVE-2010-2039
Cross-site request forgery CSRF vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an AdminUsers action to index.php. NOTE: some of these details are obtained from third...
CVE-2010-2039
gpEasy CMS versions 1.6.2, 1.6.1 and earlier are vulnerable to Cross-site request forgery (CSRF) that lets remote attackers hijack administrator sessions via an Admin_Users action to index.php and create new admin users. Root cause: CSRF in the administrative user-creation flow, enabling unauthor...
CVE-2010-2039: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in gpEasy CMS 1.6.2, 1.6.1, and earlier allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an AdminUsers action to index.php. NOTE: some of these details are obtained from third...
gpEasy 1.6.1 - Cross-Site Request Forgery (Add Admin)
gpEasy 1.6.1 - Cross-Site Request Forgery Add Admin ============================================= gpEasy Date : 04-29-2010 Site : http://www.giudinvx.altervista.org/ Location : Naples, Italy -------------------------------------------------------- Application Info Site : http://www.gpeasy.com/...
gpEasy 1.5RC3 Remote File Inclusion
Exploit Title: gpEasy = 1.5RC3 Remote FIle Include Exploit Date: 18-12-2009 Author: cr4wl3r Software Link: http://sourceforge.net/projects/gpeasy/files/ Version: N/A Tested on: GNU/LINUX Code adminpassword.php : requireonce$GLOBALS'rootDir'.'/include/admin/adminusers.php'; 3xplo!t :...
EsFaq 2.0 - 'idcat' SQL Injection
|| | | EsFaq Remote Sql Injection Exploit | | |---------------------SuB-ZeRo----------------------| | | Author: SuB-ZeRo | | Home : www.dz-security.com | | email: [email protected] | | | | | | | script :http://editeurscripts.com/ressources/scripts-php/dl.php?idscript=5 | | DorK :...
Vastal I-Tech Software Zone - 'cat_id' SQL Injection
--==+================================================================================+==-- --==+ Software Zone SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...
Yvora CMS 1.0 - 'error_view.php?ID' SQL Injection
Yvora CMS v1.0 - Remote SQL Injection Vendor : http://www.yvora.nl/ Found By : k1tk4t - k1tk4t4tnewhack.org Location : Indonesia -- newhackdotorg @irc.dal.net POC; http://www.victim.xxx/errorview.php?ID=SQL Contoh;...
PHPVID 0.9.9 - 'categories_type.php' SQL Injection
--==+================================================================================+==-- --==+ phpVID SQL Injection Vulnerbilitys +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE: http://www.vastal.com/ DORK:...
