CVE-2018-11349

The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: searchbyname, searchbyhash, and searchlink...

CVE-2018-11349

The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: searchbyname, searchbyhash, and searchlink...

CVE-2018-11349

The administration panel of Jirafeau before 3.4.1 is vulnerable to three CSRF attacks on search functionalities: searchbyname, searchbyhash, and searchlink...

CVE-2018-8898

A flaw in the authentication mechanism in the Login Panel of router D-Link DSL-3782 A1WI20170303 || SWVer="V100R001B012" FWVer="3.10.0.24" FirmVer="TT77616E6771696F6E67" allows unauthenticated attackers to perform arbitrary modification read, write to passwords and configurations meanwhile an...

Dolibarr Arbitrary Command Execution Vulnerability

Dolibarr is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A command injection vulnerability exists in the administration panel i...

CVE-2018-10682

An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default auto-deployment permits an...

Remote code execution

DISPUTED An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default auto-deployment...

CVE-2018-10682

An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default auto-deployment permits an...

iScripts eSwap Cross-Site Request Forgery Vulnerability

IScripts eSwap is an item trading software from IScripts Inc. The program supports the use of virtual currencies for trading or direct item exchange.User Panel is one of the user panels. A cross-site request forgery vulnerability exists in iScripts eSwap v2.4. The vulnerability can be exploited t...

CVE-2014-4613

Cross-site request forgery CSRF vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php...

CVE-2014-4613

Cross-site request forgery CSRF vulnerability in the administration panel in Piwigo before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests that add users via a pwg.users.add action in a request to ws.php...

Sql injection

Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator...

CVE-2018-6883

Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator...

DS Data Systems KonaKart eCommerce Platform Directory Traversal Vulnerability

DS Data Systems KonaKart eCommerce Platform is a Java-based eCommerce software from DS Data Systems, UK. The software enhances modules such as shopping cart, payment and order summarization. A directory traversal vulnerability exists in the administration panel of DS Data Systems KonaKart eCommer...

WordPress Administration Panel Login Form Detected

WordPress Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...

PT-2017-14242 · WordPress · Easyappointments

Name of the Vulnerable Software and Affected Versions: Easy Appointments plugin versions prior to 1.12.0 Description: The issue concerns a cross-site scripting XSS flaw. This flaw is located in the Settings values within the admin panel. Recommendations: For versions prior to 1.12.0, update to...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2017-29528)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports email archiving, SmartAttach attachments, automatic migration and more. A cross-site scripting vulnerability exists in the administration panel of IceWarp Mail Server version 10.4.4. A remote attacker can exploit...

Bitcoin / Dogecoin Mining 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Bitcoin,Dogecoin Mining 1.0 - Authentication Bypass Dork: N/A Date: 21.08.2017 Vendor Homepage: https://codecanyon.net/user/bousague Software Link: https://codecanyon.net/item/bitcoindogecoin-mining-php-script/20315581 Demo:...

(Bitcoin Dogecoin) PHP Cloud Mining Script - Authentication Bypass

Bitcoin Dogecoin PHP Cloud Mining Script - Authentication Bypass Exploit Title: Bitcoin,Dogecoin Mining 1.0 - Authentication Bypass Dork: N/A Date: 21.08.2017 Vendor Homepage: https://codecanyon.net/user/bousague Software Link: https://codecanyon.net/item/bitcoindogecoin-mining-php-script/2031558...

Doctor Patient Project 1.0 SQL Injection

Exploit Title: Doctor Patient Project 1.0 - Multiple Vulnerabilities Dork: N/A Date: 17.08.2017 Vendor Homepage : http://surajkumar.in/ Software Link: http://surajkumar.in/product/doctor-patient-project-php/ Demo: http://surajkumar.in/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx6...