1777 matches found
python-aiohttp: HTTP request smuggling via llhttp HTTP request parser
A flaw was found in aio-libs aiohttp, where it is vulnerable to HTTP request smuggling, caused by a flaw in the aiohttp.web.Application. By sending a specially crafted HTTPS request, an attacker can poison the web cache, bypass web application firewall protection, and conduct Cross-site scripting...
CVE-2024-22179
The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account takeover and arbitrary password change...
WordPress Plugin ActiveCampaign 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
CVE-2024-1602 Stored XSS leading to RCE in parisneo/lollms-webui
parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting XSS that leads to Remote Code Execution RCE. The vulnerability arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within t...
lollms-webui 操作系统命令注入漏洞
LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. An operating system command injection vulnerability exists in lollms-webui that stems from incorrect validation of user-supplied input...
The vulnerability of the log management page (journals) of the web application of the command-and-control platform for NorthStar C2 penetration testing allows a attacker to execute arbitrary code.
The vulnerability of the log management page journal of the command-and-control platform-based web application for NorthStar C2 exists due to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Cisco Identity Services Engine 安全漏洞
Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. The Cisco Identity Services Engine suffers from...
The vulnerability of the Java-based web application framework Apache Wicket, related to the manipulation of cross-site requests, allows a hacker to perform a CSRF attack.
The vulnerability of the Java-based web application framework Apache Wicket relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack using a specially created web page...
Employee Management System 1.0 - (txtusername) and (txtpassword) SQL Injection Vulnerability
Exploit Title: Employee Management System 1.0 - txtusername and txtpassword SQL Injection Admin Login Exploit Author: Yevhenii Butenko Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/16999/employee-management-system.html Version: 1.0 Tested on:...
Employee Management System 1.0 - (txtfullname) and (txtphone) SQL Injection Vulnerability
Exploit Title: Employee Management System 1.0 - txtfullname and txtphone SQL Injection Exploit Author: Yevhenii Butenko Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/16999/employee-management-system.html Version: 1.0 Tested on: Debian CVE :...
U.S. Dept Of Defense: Missing Access Control Allows for User Creation and Privilege Escalation
The RSI Test Environment application had a vulnerability that allowed unauthenticated users to create new user accounts and grant them administrator privileges. This provided unauthorized access to restricted information and documents within the application...
IBM WebSphere Application Server Liberty 跨站脚本漏洞
IBM WebSphere Application Server Liberty is a Java application server from International Business Machines IBM built on top of the Open Liberty project. A cross-site scripting vulnerability exists in IBM WebSphere Application Server Liberty versions 23.0.0.3 through 24.0.0.3, which stems from the...
Complete Online Beauty Parlor Management System /admin-profile.php File SQL Injection Vulnerability
Complete Online Beauty Parlor Management System is an online beauty parlor management system. The Complete Online Beauty Parlor Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the adminname parameter of...
CVE-2024-2465 Open redirection in CDeX
Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX application versions through 5.7.1...
The vulnerability of the application layer in real-time content management system SQL Directus, related to the use of incorrect alias names, allows attackers to bypass the password protection for arbitrary users.
The vulnerability of the application layer in real-time database content management system SQL Directus is related to the use of names with incorrect references. Exploiting this vulnerability could allow an attacker to reset the password of an arbitrary user remotely...
The vulnerability in the web interface for controlling Cisco AppDynamics Controller allows a attacker to perform XSS attacks.
The vulnerability in the web interface for controlling Cisco AppDynamics Controller software is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
laviecorrezienne.fr Cross Site Scripting vulnerability OBB-3867847
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Improper Authorization
github.com/1Panel-dev/1Panel/ is vulnerable to Improper Authorization. The vulnerability is due to insufficient access controls, allowing attackers to exploit the application to gain unauthorized access to the console page...
Pz-LinkCard < 2.5.3 - Reflected XSS
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page containing the code below ' /...
