Opencart 3 Extension TMD Vendor System - Blind SQL Injection Exploit

Exploit Title: Opencart 3 Extension TMD Vendor System - Blind SQL Injection Author: Muhammad Zaki Sulistya email protected Product: TMD Vendor System Vendor Homepage: https://www.opencartextensions.in/ Software Link: https://www.opencartextensions.in/opencart-multi-vendor-multi-seller-marketplace...

Opencart 3 Extension TMD Vendor System SQL Injection

Exploit Title: Opencart 3 Extension TMD Vendor System - Blind SQL Injection Author: Muhammad Zaki Sulistya [email protected] Date: 03-11-2021 Product: TMD Vendor System Vendor Homepage: https://www.opencartextensions.in/ Software Link:...

CVE-2021-37808

SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the 1 category, 2 subcategory, 3 sucatdescription, and 4 username parameters, the server response is about N seconds delay respectively which mean it is vulnerable to MySQL Blind Time Based. An attacker can...

CVE-2021-37806

An SQL Injection vulnerability exists in https://phpgurukul.com Vehicle Parking Management System affected version 1.0. The system is vulnerable to time-based SQL injection on multiple endpoints. Based on the SLEEPN function payload that will sleep for a number of seconds used on the 1 editid , 2...

CVE-2021-37806

An SQL Injection vulnerability exists in https://phpgurukul.com Vehicle Parking Management System affected version 1.0. The system is vulnerable to time-based SQL injection on multiple endpoints. Based on the SLEEPN function payload that will sleep for a number of seconds used on the 1 editid , 2...

CVE-2021-37808

SQL Injection vulnerabilities exist in https://phpgurukul.com News Portal Project 3.1 via the 1 category, 2 subcategory, 3 sucatdescription, and 4 username parameters, the server response is about N seconds delay respectively which mean it is vulnerable to MySQL Blind Time Based. An attacker can...

PT-2021-21878 · Unknown · News Portal Project

Name of the Vulnerable Software and Affected Versions: News Portal Project version 3.1 Description: SQL Injection vulnerabilities exist in the News Portal Project via the category, subcategory, sucatdescription, and username parameters. The server response is delayed by about N seconds, indicatin...

CVE-2021-41792

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to...

Server side request forgery (ssrf)

An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to...

CVE-2021-41792

CVE-2021-41792 affects Hyland Alfresco components: org.alfresco:alfresco-content-services up to 6.2.2.18 and org.alfresco:alfresco-transform-services up to 1.3. A crafted HTML file uploaded to the system could trigger an unexpected request by the transformation engine, with the response not expos...

A Matter of Perspective: Agent-Based and Agentless Approaches to Cloud Security, Part 1

When it comes to securing your cloud assets' activities at runtime, the first step is deciding how. There are enough possible solutions that you're likely to find yourself at a crossroads trying to decide between them. The factors that may affect your choice include: Friction level — How...

Online Motorcycle (Bike) Rental System 1.0 SQL Injection

Exploit Title: Online Motorcycle Bike Rental System 1.0 - Blind Time-Based SQL Injection Unauthenticated Exploit Author: Chase ComardelleCASO Date: October 18, 2021 Vendor Homepage: https://www.sourcecodester.com/php/14989/online-motorcycle-bike-rental-system-phpoop-source-code.html Software Link...

Online Motorcycle (Bike) Rental System 1.0 - Blind Time-Based SQL Injection Exploit

Exploit Title: Online Motorcycle Bike Rental System 1.0 - Blind Time-Based SQL Injection Unauthenticated Exploit Author: Chase ComardelleCASO Vendor Homepage: https://www.sourcecodester.com/php/14989/online-motorcycle-bike-rental-system-phpoop-source-code.html Software Link:...

marylandschoolfortheblind.org Improper Access Control vulnerability OBB-2178256

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-nu11-101821

Description: The useremail parameter appears to be vulnerable to SQL injection attacks Time-based Blind. A single quote was submitted in the useremail parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. Recent assessments:...

IFSC Code Finder Project 1.0 SQL Injection Vulnerability

IFSC Code Finder Project 1.0 SQL Injection Vulnerability CVE-2021-42224 Vendor Description: - vulnerability: all or nothing SQL Injection vulnerability exists in IFSC Code Finder Project 1.0 via the searchifsccode POST parameter in /search.php. The searchifsccode parameter appears to be vulnerabl...

Code Injection in flatcore/flatcore-cms

Description Another code injection payload in linkname. Proof of Concept Insert into linkname $sleep 10 Go to http://FLATCORE-IP/flatCore-CMS/content/cache/cachelastedit.php and see that the page has stopped for 10 seconds. $ escapes the string, switches context to OS commands. Impact Blind RCE a...

X (Formerly Twitter): Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive data

The researcher demonstrated a vulnerability in Twitter's Jira instance where user supplied information was handled in an improper manner, rendering the application vulnerable to blind XSS. By crafting a bug report and sending it to Twitter it was possible to locate this proof of concept code with...

Exploit for Server-Side Request Forgery in Redhat Keycloak

Keycloak-12.0.1-CVE-2020-10770 Keycloak 12.0.1 - 'requestu...

Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated)

Exploit Title: Keycloak 12.0.1 - 'requesturi ' Blind Server-Side Request Forgery SSRF Unauthenticated Date: 2021-10-09 Exploit Author: Mayank Deshmukh Vendor Homepage: https://www.keycloak.org/ Software Link: https://www.keycloak.org/archive/downloads-12.0.1.html Version: versions 192.168.0.1:444...