WordPress BerqWP plugin <= 1.7.5 - Unauthenticated Non-Blind Server Side Request Forgery (SSRF) vulnerability

Unauthenticated Non-Blind Server Side Request Forgery SSRF vulnerability discovered by Dave Jong Patchstack in WordPress Plugin BerqWP versions = 1.7.5...

CVE-2024-39699 Directus has a Blind SSRF On File Import

Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security...

CVE-2024-39699 Directus has a Blind SSRF On File Import

Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security...

GHSA-8P72-RCQ4-H6PW Directus Blind SSRF On File Import

Summary There was already a reported SSRF vulnerability via file import. https://github.com/directus/directus/security/advisories/GHSA-j3rg-3rgm-537h It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security...

WordPress Poll 2.3.6 SQL Injection

Exploit Title: WordPress Poll Plugin SQL Injection Date: 2024-07-06 Exploit Author: tmrswrr Category : Webapps Vendor Homepage: https://total-soft.com/wp-poll/ Version 2.3.6 1. Access the Admin Panel: - Navigate to the admin panel of your WordPress site. - Go to TS Poll Create Pool Use Theme and...

Azon Dominator Affiliate Marketing Script - SQL Injection Vulnerability

Exploit Title: Azon Dominator - Affiliate Marketing Script - SQL Injection Exploit Author: Buğra Enis Dönmez Vendor: https://www.codester.com/items/12775/azon-dominator-affiliate-marketing-script Demo Site: https://azon-dominator.webister.net/ Tested on: Arch Linux CVE: N/A Request POST...

Xhibiter NFT Marketplace 1.10.2 - SQL Injection Vulnerability

Exploit Title: xhibiter nft marketplace SQLI Google Dork: intitle:"View - Browse, create, buy, sell, and auction NFTs" Exploit Author: Sohel yousef - https://www.linkedin.com/in/sohel-yousef-50a905189/ Vendor Homepage: https://elements.envato.com/xhibiter-nft-marketplace-html-template-AQN45FA...

WordPress plugin Email Subscribers by Icegram Express Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the WordPress plugin...

CVE-2024-37765

Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page...

Exploit for SQL Injection in Machform

Description MachForm up to version 19 is affected by an authen...

Simple Laboratory Management System 1.0 SQL Injection

Exploit Title: Simple Laboratory Management System - Manual Blind Time Based SQL Injection Exploit Description: A SQL Injection vulnerability in Computer Laboratory Management System v1.0 allows attackers to execute arbitrary SQL commands on the database server which causes the services to delay ...

PT-2024-27737 · Machform · Machform

Name of the Vulnerable Software and Affected Versions: Machform versions prior to 20 Description: The issue is related to an authenticated Blind SQL injection in the user account settings page. Recommendations: For versions prior to 20, update to version 20 or later to resolve the issue...

Xhibiter NFT Marketplace 1.10.2 SQL Injection

Exploit Title: xhibiter nft marketplace SQLI Google Dork: intitle:"View - Browse, create, buy, sell, and auction NFTs" Date: 29/06/204 Exploit Author: Sohel yousef - https://www.linkedin.com/in/sohel-yousef-50a905189/ Vendor Homepage:...

CVE-2024-3816

Sites managed in S@M CMS Concept Intermedia might be vulnerable to a blind SQL Injection executed using the search bar. Only a part of observed services is vulnerable, but since vendor has not investigated the root problem, it is hard to determine when the issue appears...

CVE-2024-3816

Sites managed in S@M CMS Concept Intermedia might be vulnerable to a blind SQL Injection executed using the search bar. Only a part of observed services is vulnerable, but since vendor has not investigated the root problem, it is hard to determine when the issue appears...

CVE-2024-3816

The CVE-2024-3816 entry concerns the S@M CMS (Concept Intermedia) platform. It states a blind SQL Injection vulnerability exploitable via the search bar, affecting only a subset of observed services; the vendor has not investigated the root cause to determine when it occurs. The CVSS v3.1 metrics...

PT-2024-27894 · Concept Intermedia · S@M Cms

Name of the Vulnerable Software and Affected Versions: S@M CMS Concept Intermedia affected versions not specified Description: The issue concerns a blind SQL Injection that can be executed using the search bar in sites managed by S@M CMS. It is noted that only a part of the observed services is...

Concept Intermedia S@M CMS Security Vulnerability

Concept Intermedia S@M CMS is a content management system from Concept Intermedia, Inc. A security vulnerability exists in Concept Intermedia S@M CMS version 3.3 and prior versions, which stems from a blind SQL injection attack executed via the search bar...

Intrado 911 Emergency Gateway Security Vulnerability

Intrado 911 Emergency Gateway is an on-premise management appliance from Intrado USA. A security vulnerability exists in Intrado 911 Emergency Gateway that stems from a login form that is susceptible to a blind SQL injection attack, which allows an attacker to execute malicious code, steal data, ...

CVE-2024-29390

Daily Expenses Management System version 1.0, developed by PHP Gurukul, contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the 'item' parameter in a POST request to execute arbitrary SQL commands in the backend database. This can be done...