26 matches found
Security Audit <= 1.0.0 - Admin+ Stored Cross Site Scripting
The plugin does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the Data ID setting of the plugin...
idreamsoft iCMS SQL Injection Vulnerability (CNVD-2019-12126)
iCMS is an efficient and simple content management system built with PHP and MySQL. A SQL injection vulnerability exists in idreamsoft iCMS 7.0.13, which can be exploited by remote attackers to execute SQL commands with the help of the 'dataid' parameter...
CVE-2019-6259
An issue was discovered in idreamsoft iCMS V7.0.13. There is SQL Injection via the app/article/article.admincp.php dataid parameter...
Code injection
Babo Violent 2 2.08.00 and earlier allows remote attackers to cause a denial of service application crash via 1 a value greater than 0x27 for the a 0xca, b 0xcb, c 0xcc, d 0xce, e 0xcf, or f 0xd0 data ID; 2 a nonexistent map name; or 3 a UDP packet that specifies a large data size...
CVE-2007-4379
Babo Violent 2 2.08.00 and earlier allows remote attackers to cause a denial of service application crash via 1 a value greater than 0x27 for the a 0xca, b 0xcb, c 0xcc, d 0xce, e 0xcf, or f 0xd0 data ID; 2 a nonexistent map name; or 3 a UDP packet that specifies a large data size...
Flipper Poll v1.1.0 (poll.php) remote file include vuln
Flipper Poll v1.1.0 poll.php remote file include vuln --------------------------------------------------------------------------------- Found: Cyber-Security cyber-security.org --------------------------------------------------------------------------------- Script Download:...