Care2x 2.7 (HIS) Hospital Information System SQL Injection

Exploit Title: Care2x 2.7 HIS Hospital Information system - Multiples SQL Injection Date: 01/17/2019 Software Links/Project: https://github.com/care2x/care2x | http://www.care2x.org/ Version: Care2x 2.7 Exploit Author: Carlos Avila Category: webapps Tested on: Windows 8.1 / Ubuntu Linux Contact:...

Wordpress Survey & Poll 1.5.7.3 Plugin - sss_params SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Survey & Poll 1.5.7.3 - 'sssparams' SQL Injection Exploit Author: Ceylan Bozogullarindan Vendor Homepage: http://modalsurvey.pantherius.com/ Software Link:...

WordPress Survey And Poll 1.5.7.3 SQL Injection

Exploit Title: Wordpress Plugin Survey & Poll 1.5.7.3 - 'sssparams' SQL Injection Date: 2018-09-09 Exploit Author: Ceylan Bozogullarindan Vendor Homepage: http://modalsurvey.pantherius.com/ Software Link: https://downloads.wordpress.org/plugin/wp-survey-and-poll.zip Version: 1.5.7.3 Tested on:...

Tenda AC15 Router Code Execution Vulnerability

Tenda AC15 router is a wireless router product from Tenda, China. A security vulnerability exists in the Tenda AC15 router. The vulnerability can be exploited by a remote attacker to execute code with the help of a specially crafted 'COOKIE' parameter...

CVE-2018-1000131

Pradeep Makone wordpress Support Plus Responsive Ticket System version 9.0.2 and earlier contains a SQL Injection vulnerability in the function to get tickets, the parameter email in cookie was injected that can result in filter the parameter. This attack appear to be exploitable via web site,...

CVE-2018-5455: Reliance on Cookies without Validation and Integrity Checking

A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows a cookie parameter to consist of only digits, allowing an attacker to perform a brute force attack bypassing...

CVE-2017-7438

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via javascript DOM modification using the supplied cookie parameter...

Cross site scripting

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via javascript DOM modification using the supplied cookie parameter...

CVE-2017-7438

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via javascript DOM modification using the supplied cookie parameter...

CVE-2017-7438 DOM cross site scripting attack against NetIQ Privileged Account Manager

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via javascript DOM modification using the supplied cookie parameter...

CVE-2017-7438: Improper Neutralization of Input During Web Page Generation

NetIQ Privileged Account Manager before 3.1 Patch Update 3 allowed cross site scripting attacks via javascript DOM modification using the supplied cookie parameter...

The vulnerability of the check_login function in the D-Link DNR-326 router microprogramming system allows a hacker to bypass the authentication process.

The vulnerability of the checklogin function in the D–Link DNR-326 router microprogramming system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and register using the user’s cookie parameter...

Netscaler SD-WAN 9.1.2.26.561201 - Command Injection (Metasploit)

Exploit Title: Citix SD-WAN logout cookie preauth Remote Command Injection Vulnerablity Date: 02/20/2017 Exploit Author: xort @ Critical Start Vendor Homepage: www.citrix.com Software Link: https://www.citrix.com/downloads/cloudbridge/ Version: 9.1.2.26.561201 Tested on: 9.1.2.26.561201 OS...

phpMyAdmin CSS Injection Vulnerability

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A CSS injection vulnerability exists in phpMyAdmin. The vulnerability can be exploited to inject CSS with the help of a specially crafted cookie parameter...

Xionghai CMS system cookie user parameters exist sql injection vulnerability

XIONGHAI CMS is developed by XIONGHAI can be widely used in personal blogs, personal websites, corporate websites, a set of integrated website management system. Applicable to personal blogs, personal websites, corporate websites and other various purposes, the front end of the computer, mobile t...

Stack Overflow Vulnerability in Lovecraft PPS ActiveX Plugin

Aiki PPS ActiveX plugin is a browser-based flash playback control. A stack overflow vulnerability exists in the strUID and strCookie parameters of the Lovecraft PPS ActiveX plugin. An attacker can exploit the vulnerability to remotely execute arbitrary code, and a failed exploit can result in a...

Skyrun TopSec Firewall cookie cid parameter command injection vulnerability

TopSec is a firewall appliance from Skyrunner. The /cgi/maincgi.cgi program in the WEB management interface of Tianrongxin firewall has a command injection vulnerability when handling the cid variable in the cookie passed from the client, which allows an attacker to execute arbitrary commands usi...

Authentication flaw

Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vectors related to reading a cookie parameter containing a UserId value...

CVE-2016-4503

Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vectors related to reading a cookie parameter containing a UserId value...

CVE-2016-4503: Improper Authentication

Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vectors related to reading a cookie parameter containing a UserId value...