iWebShop open source mall system has xss vulnerability

iWebShop open source mall system is a PHP language and MYSQL database based on the development of B2B2C single-user and multi-user open source mall system . The system is divided into front-end , back-office and merchant . iWebShop open source mall system has an xss vulnerability that can be...

LibVNC Null Pointer Reverse Reference Vulnerability

LibVNC is a cross-platform C library for implementing VNC server and client functionality. A null pointer back-reference vulnerability exists in VNC client code in versions prior to LibVNC commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7. An attacker could exploit this vulnerability to cause a...

Quest NetVault Backup Server < 11.4.5 Process Manager Service SQL Injection Remote Code Execution Vulnerability (ZDI-17-982)

The version of Quest NetVault Backup Server running on the remote host is prior to 11.4.5. It is, therefore, affected by an SQL injection SQLi remote code execution vulnerability in the process manager server due to improper validation of user-supplied input. An unauthenticated, remote attacker c...

Emotet Trojan Detection

The script tries to detect the Emotet Trojan via various known Indicators of Compromise IOC. Note: This script is not running by default as it needs to crawl the target host for various files which puts high load on the target during the scan. Please enable it separately within scripts preference...

Viewing unauthorized records in the back end

Date : 2018-12-13 CVE ID : CVE-2018-20028 Description The vulnerability allows logged in back end users to view records that have not been enabled for them. There are two ways to exploit the vulnerability: 1. If a back end user without page mounts uses the filter menu in the site structure, they...

PrestaShop 1.6.x / 1.7.x Remote Code Execution

?php / PrestaShop 1.6.x = 1.6.1.23 & 1.7.x = 1.7.4.4 - Back Office Remote Code Execution See https://github.com/farisv/PrestaShop-CVE-2018-19126 for explanation. Chaining multiple vulnerabilities to trigger deserialization via phar. Date: December 1st, 2018 Author: farisv Vendor Homepage:...

PrestaShop 1.6.x/1.7.x - Remote Code Execution Exploit

Exploit for php platform in category web applications ?php / PrestaShop 1.6.x = 1.6.1.23 & 1.7.x = 1.7.4.4 - Back Office Remote Code Execution See https://github.com/farisv/PrestaShop-CVE-2018-19126 for explanation. Chaining multiple vulnerabilities to trigger deserialization via phar. Date:...

Code execution vulnerability in zzzcms v1.5.8 backend sa***.php file

zzcms is a free website builder developed in asp language. zzzcms v1.5.8 code execution vulnerability exists in the background sa.php file. An attacker can exploit this vulnerability to execute arbitrary code...

PrestaShop 1.6.x1.7.x - Remote Code Execution

PrestaShop 1.6.x1.7.x - Remote Code Execution ?php / PrestaShop 1.6.x = 1.6.1.23 & 1.7.x = 1.7.4.4 - Back Office Remote Code Execution See https://github.com/farisv/PrestaShop-CVE-2018-19126 for explanation. Chaining multiple vulnerabilities to trigger deserialization via phar. Date: December 1st...

PrestaShop 1.6.x/1.7.x - Remote Code Execution

?php / PrestaShop 1.6.x = 1.6.1.23 & 1.7.x = 1.7.4.4 - Back Office Remote Code Execution See https://github.com/farisv/PrestaShop-CVE-2018-19126 for explanation. Chaining multiple vulnerabilities to trigger deserialization via phar. Date: December 1st, 2018 Author: farisv Vendor Homepage:...

PT-2018-15249

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 71.0.3578.80 Description A remote attacker could confuse the user about the origin of the current page via a crafted HTML page, due to an issue where a renderer-initiated back navigation was incorrectly allowed ...

RHEL 7 : openshift (RHSA-2015:2544)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:2544 advisory. OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud...

Exploit for Unrestricted Upload of File with Dangerous Type in Prestashop

PrestaShop Back Office Remote Code Execution CVE-2018-19126...

zzzcms V1.5.7 php official version of the back-end code execution vulnerabilities exist

zzcms is a free and open source building system, mainly facing the majority of webmasters to use. zzzcms V1.5.7 php official version of the background sa.php file editfile function there is a code execution vulnerability, an attacker can take advantage of the vulnerability to execute arbitrary co...

PointOfSales SQL Injection Vulnerability

PointOfSales is a point of sale system. The system includes features such as inventory management, customer management and performance management. A SQL injection vulnerability exists in PointOfSales version 1.0. A remote attacker can exploit this vulnerability to view, add, modify, or delete...

Curriculum Evaluation System SQL Injection Vulnerability

Curriculum Evaluation System is a curriculum evaluation system. A SQL injection vulnerability exists in Curriculum Evaluation System version 1.0. A remote attacker can use the login page to view, add, modify, or delete information in the back-end database...

BSEN Ordering software SQL Injection Vulnerability

BSEN Ordering software is a procurement management system. A SQL injection vulnerability exists in BSEN Ordering software version 1.0. A remote attacker can use the vulnerability to view, add, modify, or delete information in the back-end database with the help of the...

Centreon SQL Injection Vulnerability

Centreon formerly known as Merethis Centreon is an open source IT monitoring software suite from Centreon France that needs to be paired with Nagios to manage Nagios via the web and third-party components to enable monitoring of networks, operating systems and applications. A SQL injection...

CVE-2018-12667

The SV3C HD Camera L-SERIES V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B is affected by an improper authentication vulnerability that allows requests to be made to back-end CGI scripts without a valid session. This vulnerability could be used to read and modify the...

CVE-2018-2887

Vulnerability in the MICROS Retail-J component of Oracle Retail Applications subcomponent: Back Office. Supported versions that are affected are 13.0.0 and 12.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Retail-J. Successf...