Web Application Vulnerability Scanner: Wapiti

Wapiti allows you to audit the security of your web applications. It performs “black-box” scans, i.e. it does not study the source code of the application but will scans the webpages of the deployed webapp, looking for scripts and forms where it can inject data. Once it gets this list, Wapiti act...

Gespage SQL Injection Vulnerability

Gespage is an application for managing and monitoring printing devices from the French company Gespage. A SQL injection vulnerability exists in Gespage. A remote attacker can exploit this vulnerability by sending the 'showprn' parameter to the webapp/users/prnow.jsp file or the 'showmonth'...

Readymade Video Sharing Script 3.2 - SQL Injection

Readymade Video Sharing Script 3.2 - SQL Injection Exploit Title: Readymade Video Sharing Script 3.2 - SQL Injection Dork: N/A Date: 09.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/php-video-sharing-script/ Version: 3.2 Category:...

adutt.fr Improper Access Control vulnerability

Open Bug Bounty ID: OBB-450536 Description| Value ---|--- Affected Website:| adutt.fr Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Remediation Guide:| OWASP Access Control Cheat Shee...

XML External Entity (XXE)

jbpm-designer-backend is vulnerable to XML external entity XXE attacks. The application does not parse XML documents properly, allowing a malicious user to conduct a XML external entity attack...

Security Advisory - A CGI application vulnerability in Some Huawei Products

Some open source software used by Huawei does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an...

Improper access control

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting roles.queries.php. It is then possible for a manager user to modify any arbitrary roles within the application, or delete any arbitrary role. To exploit the vulnerability, an authenticated attacker must have...

Monstra CMS 3.0.4 Cross Site Scripting

| | Exploit Title: Monstra cms Cross Site ScriptingXSS | Exploit Author: Ashiyane Digital security Team | Vendor Homepage : http://monstra.org/ | Software Link: https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip | Version: 3.0.4 | Date: 2017-11-13 | Category: Webapps | Tested on:...

SQL Injection Vulnerability in MIPCMS ApiAdminUser.php Page

MIPCMS is a free and open source based on Baidu Mobile Accelerator MIP engine based on the development of articles, information, content management system, but also the system for the Internet webmasters, entrepreneurs and other groups to create SEO-optimized after the station-building system. A...

Ingenious 2.3.0 - Arbitrary File Upload

Exploit Title: Ingenious School Management System 2.3.0 - Arbitrary File Upload Dork: N/A Date: 30.10.2017 Vendor Homepage: http://iloveprograming.com/ Software Link: https://www.codester.com/items/4945/ingenious-school-management-system Demo: http://iloveprograming.com/view/login.php Version: N/...

linkconnector.com XSS vulnerability

Vulnerable URL: https://www.linkconnector.com/affiliates/affiliate-application/?cid=x%22%3E%3CsvG%20onLoad=prompt9%3E=149989 Details: Description| Value ---|--- Patched:| Verification in progress Latest check for patch:| 15.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

Lend a Little Loan App Has Arbitrary User Registration Vulnerability

Lend a little with a loan app is an emergency loan platform. There is an arbitrary user registration vulnerability in Lend a Little with Loan APP. Attackers can register any account by grabbing packets and blasting CAPTCHA...

CVE-2017-15084

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

CVE-2017-14623

In the ldap.v2 aka go-ldap package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: 1 it relies only on the return error of the Bind function call to determine whether a user is...

Lessons Learned from the Equifax Disaster

143 million U.S. consumers, Equifax.com users who may have been affected by the the worst data breach in history are receiving all sorts of advice including a free TrustedID product license from Equifax. But despite numerous public reports about the incident, there are still many important...

ICCallLimousine 1.1 - key SQL Injection

ICCallLimousine 1.1 - key SQL Injection Exploit Title: Car Rental Script 1.1 - SQL Injection Dork: N/A Date: 13.09.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Link: http://www.icloudcenter.com/limousine-car-hire-script.html Demo: http://icloudcenter.net/demos/iccalllimousine/...

Job Board Software 1.0 - SQL Injection

Exploit Title: Job Board Software 1.0 - SQL Injection Dork: N/A Date: 09.09.2017 Vendor Homepage: http://scriptzee.com/ Software Link: http://scriptzee.com/best-softwares/job-board-software Demo: http://jobsite.scriptzee.com/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A...

Breach at Equifax May Impact 143M Americans

Equifax, one of the "big-three" U.S. credit bureaus, said today a data breach at the company may have affected 143 million Americans, jeopardizing consumer Social Security numbers, birth dates, addresses and some driver's license numbers. In a press release today, Equifax NYSE:EFX said it...

Palm Edge AliCloud OSS credentials have information leakage vulnerabilities

Palm Edge APP is a mobile unit association dating activities software. There is an information leakage vulnerability in the Palm Edge AliCloud OSS credentials. The vulnerability is caused by credential leakage due to the use of SDK with accessKeyId and accessKeySecret, endpoint built into the...

Denial Of Service (DoS) Through Memory Leak

ImageMagick is vulnerable to denial of service DoS attacks through a memory leak. A malicious user can pass a MAT image file to the application to cause memory leaks, leading to the application running out of memory and crashing it...