Universal Password Login Vulnerability in Longcai MX of Longcai Technology Inc.

Longcai MX is a marketing website that caters to consumer needs and buying desires. A universal password login vulnerability exists in the '/manage' page of Longcai MX under Longcai Technology. An attacker can exploit the vulnerability to log into the system backend, view sensitive information or...

ZYCH Free Planning Enterprise Website Management System Exists Universal Password Login Vulnerability

ZYCH Free Planner Enterprise Website Management System is an intelligent ASP website management program based on Free Planner Enterprise Website Management System. A universal password login vulnerability exists in the '/admin/login.asp' page of ZYCH Free Planning Enterprise Website Management...

SQL Injection Vulnerability in Nanchang Jiarui Website Building System

Nanchang Jiarui Technology is a company specializing in all aspects of the application of enterprise information technology services, business scope includes: mobile APP development, website construction, software development, full network promotion, micro letter marketing. A SQL injection...

Unauthorized access vulnerability in HP Photosmart 5520 series printers

The HP Photosmart 5520 series is a mid-range inkjet printer. An unauthorized access vulnerability exists in the HP Photosmart 5520 series printer. The vulnerability allows an attacker to enter the backend of the printer and view sensitive information or perform unauthorized operations...

QNAP Photo Station and Music Station Authentication Bypass Vulnerability

QNAP Photo Station, Music Station is an application that displays photos and music stored in all shared folders. An authentication bypass vulnerability exists in QNAP Photo Station version 5.2.4 and Music Station version 4.8.4. The vulnerability allows attackers to bypass authentication to enter...

csrf vulnerability in dedecms v5.7 latest version

Dedecms is an open source PHP open source website management system. A csrf vulnerability exists in the latest version of dedecms v5.7. Allows attackers to exploit the vulnerability to forge form links and trick administrators to click and add backend accounts...

ZYCHCMS V04 Login Authentication Bypass Vulnerability in /admin/login.asp File

ZYCHCMS is an enterprise website management system. A login authentication bypass vulnerability exists in the /admin/login.asp file in ZYCHCMS V04. The vulnerability allows attackers to bypass authentication to enter the backend and obtain sensitive information...

Unauthorized Access Vulnerability in Zhongke Dayang 3GLive Multimedia Gateway

ZTE 3GLive multimedia is relying on 3G network technology to provide a new means of live broadcasting. Unauthorized access vulnerability exists in the 3GLive Multimedia Gateway, which can be exploited by unauthorized attackers to access /monitor?lan=1 to directly enter the backend...

Stored Cross-Site Scripting Vulnerability in Goo App

Gudong is a GPS sports social mobile software to track sports routes and discover sports information and anecdotes. A stored XSS vulnerability exists in the GooDong app. An attacker can use the vulnerability to obtain an administrator cookie and enter the backend via the cookie...

Vulnerability of Universal Password Login in Bozhong Travel Distribution System

The BoZone Travel Distribution System is an integrated product consisting of a series of related products. A universal password login vulnerability exists in the BoZone Travel Distribution System, which can be exploited by an attacker to gain direct access to the backend and obtain sensitive...

Weak Password Vulnerability in Web Management System of Xi'an Netcom Network Technology Co.

Xi'an Netcom Network Technology Co., Ltd. website management system is to provide customers with a total solution for network marketing. A weak password vulnerability exists in the website management system of Xi'an Netco Network Technology Co. An attacker can utilize the default background as:...

Multiple vulnerabilities in phpcms

phpcms is an open source content management system. Multiple vulnerabilities exist in phpcms. Attackers use the vulnerabilities to log into the backend of phpssoserver to obtain sensitive information...

TaoCMS v2.5Beta4 Comment.php 存在储存型xss漏洞(可打后台)

No description provided by source...

用友项目管理系统设计不当可以登入获取大量敏感信息

简要描述： 用友项目管理系统设计不当可以登入获取大量敏感信息 详细说明： 用友产品缺陷管理系统使用了JIRA，对外网开放了后台访问和注册权限，导致可以任意注册用进行登录查看相关项目信息 泄露后台：http://123.103.9.112/login.jsp 注册地址：http://123.103.9.112/secure/Signup!default.jspa 漏洞证明：...

[RT-SA-2015-002] SQL Injection in TYPO3 Extension Akronymmanager

Advisory: SQL Injection in TYPO3 Extension Akronymmanager An SQL injection vulnerability in the TYPO3 extension "Akronymmanager" allows authenticated attackers to inject SQL statements and thereby read data from the TYPO3 database. Details ======= Product: sbakronymmanager Affected Versions: =0.5...

Live off the mobile phone client xss comfortably into the background-bug warning-the black bar safety net

Brief description: Live off the mobile phone client sidexsscomfortably, you can log in the background Detailed description: 0x00 keywords code area Live off to find room Android App, user feedback, comfortably, the storage-typexss, the'" 0x02 process User feedback directly inserted into the !...

CVE-2014-3945

The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a...

Authentication flaw

The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a...

Maccms V8 XSS可打后台 #3

简要描述： 刚发了个后台getshell，但是屌丝的攻城狮要怎么进入后台呢？XSS呀 本应该两个洞一起发的，xss+后台getshell=getshell，手快发早了，只好再找个其它的接口来充数了 详细说明： 在留言板本处 插入即可 打后台 漏洞证明： 结合后台漏洞攻击： 1. 后台任意文件删除，可删除install.lock导致重装 接口 http://localhost/maccms8/admin/?m=extend-picdel post参数： fname%5B%5D=..%2Fupload%2Fart%2F..%5C%5C..%5C%5C\inc\install.lock 2...

亿中邮（亿邮）信息技术官方网站沦陷,已成功进入后台

简要描述： 今天本身没事。为了不让他买叫我盲打王。 所以就打算随便找一个厂商 进行一次 脚本入侵。然后就找到了“亿中邮信息技术” 我大概说一下。没拿下webshell 后台设置了禁止写入。包括数据库备份 根本不可能。另外上传页面直接删除掉了。 但是你们网站的问题很大。 整个入侵过程一共是 20分钟。你们后台就沦陷了！·下面我大概讲一下入侵的整个思路 详细说明： 首先是网站主站有个意见反馈。然后我就很随意的 插入代码了。但是。返回的提交成功 一看就知道 dedecms页面。 然后我就知道。肯定是 失败的。 然后打开data/admin/ver.txt 发现版本很老啊。...