9053 matches found
CVE-2021-41651
CVE-2021-41651 describes a blind SQL injection in the Raymart DG / Ahmed Helal Hotel-mgmt-system. The vulnerability resides in the vulnerable parameter cid of process_update_profile.php , allowing an attacker to retrieve sensitive database information via unauthenticated, time-based blind techniq...
Local Offices Contact Directory Site SQL Injection
https://www.sourcecodester.com/php/14973/local-offices-contact-directory-site-using-php-and-sqlite-free-source-code.html Vendor: href Description: The search parameter appears to be vulnerable to time-based blind SQL injection attacks, on the web app "Local Offices Contact Directories Site" by...
CVE-2020-20797
FlameCMS 3.3.5 contains a time-based blind SQL injection vulnerability in /account/register.php...
Exploit for SQL Injection in Online-Shopping-System-Advanced_Project Online-Shopping-System-Advanced
CVE-2021-41648 CVE-2021-41648 SQL Injection in online-shoppin...
Exploit for SQL Injection in Hotel_Management_System_Project Hotel_Management_System
CVE-2021-41651 CVE-2021-41651 SQL Injection in hotel-mgmt-sys...
Exploit for SQL Injection in Online-Shopping-System-Advanced_Project Online-Shopping-System-Advanced
CVE-2021-41649 CVE-2021-41649 SQL Injection in online-shoppin...
A7: Cross-Site Scripting (XSS) — Top 10 OWASP 2017
A7: Cross-Site Scripting XSS 💻 — Top 10 OWASP 2017 Introduction XSS is one of my favourite vulnerability types because of the depth and complexity. It all seems so super simple but when you really get down to the core of XSS there is a world of wonder to explore. Besides the different types of XS...
E-Negosyo System 1.0 SQL Injection
Exploit Title: E-Negosyo System 1.0 - Time-Based Blind SQLi - admin/login.php Date: 2021-09-22 Exploit Author: Janik Wehrli Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsenordering0.zip Version:...
E-Negosyo System 1.0 SQL Injection Vulnerability
Exploit Title: E-Negosyo System 1.0 - Time-Based Blind SQLi - admin/login.php Exploit Author: Janik Wehrli Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsenordering0.zip Version: 1.0 Category:...
Hikvision IP Camera Unauthenticated Command Injection
This module exploits an unauthenticated command injection in a variety of Hikvision IP cameras CVE-2021-36260. The module inserts a command into an XML payload used with an HTTP PUT request sent to the /SDK/webLanguage endpoint, resulting in command execution as the root user. This module...
Library Management System 1.0 SQL Injection
Exploit Title: Library Management System 1.0 - Blind Time-Based SQL Injection Unauthenticated Exploit Author: Bobby Cooke @0xBoku & Adeeb Shah @hyd3sec Date: 16/09/2021 Vendor Homepage: https://www.sourcecodester.com/php/12469/library-management-system-using-php-mysql.html Software Link:...
XssHunter-Express 授权问题漏洞
XssHunter-Express is used to test and find blind XSS. XssHunter-Express suffers from an Authorization Problem vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...
Library Management System 1.0 - Blind Time-Based SQL Injection (Unauthenticated)
Exploit Title: Library Management System 1.0 - Blind Time-Based SQL Injection Unauthenticated Exploit Author: Bobby Cooke @0xBoku & Adeeb Shah @hyd3sec Date: 16/09/2021 Vendor Homepage: https://www.sourcecodester.com/php/12469/library-management-system-using-php-mysql.html Software Link:...
A4: XML External Entities (XXE) ❗️ — Top 10 OWASP 2017
A4: XML External Entities XXE ❗️ — Top 10 OWASP 2017 Introduction XML presents a useful resource for sending data from service to service and for data processing internally but with anything, as soon as user input gets involved, things get dangerous. The processing of these files comes with an...
Judge.me : Blind XSS via Feedback form.
Summary: Hi Team, I found Blind XSS which is triggered on the admin panel. I was trying to add widgets on the installation page for default theme. When the installation was done, I saw a question like that Are you happy with how everything looks?. I clicked the No, please remove all widgets butto...
APT-C-36 Updates Its Spam Campaign Against South American Entities With Commodity RATs
We have continued tracking APT-C-36, also known as Blind Eagle, since our research on this threat actor in 2019. We share new findings of APT-C-36’s ongoing spam campaign targeting South American entities...
CVE-2021-3772
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses...
CVE-2021-3772
A flaw was found in the Linux SCTP stack. A blind attacker may be able to kill an existing SCTP association through invalid chunks if the attacker knows the IP-addresses and port numbers being used and the attacker can send packets with spoofed IP addresses. Mitigation As the SCTP module will be...
