PT-2024-23159

Name of the Vulnerable Software and Affected Versions Sina Extension for Elementor versions through 3.5.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

Online Examination System SQL注入漏洞

Online Examination System is an online examination system. A SQL injection vulnerability exists in Online Examination System version 1.0, which originates from the id parameter of the /adminpanel/admin/query/deleteQuestionExe.php file that lacks validation of externally entered SQL statements. An...

Nagios XI Version 2024R1.01 - SQL Injection Exploit

Exploit Title: NAGIOS XI SQLI Exploit Author: Jarod Jaslow MAWK https://www.linkedin.com/in/jarod-jaslow-codename-mawk-265144201/ Vendor Homepage: https://www.nagios.com/changelog/nagios-xi Software Link: https://github.com/MAWK0235/CVE-2024-24401 Version: Nagios XI Version 2024R1.01 Tested on:...

Online Book System SQL注入漏洞

Online Book System is an online booking system. A SQL injection vulnerability exists in Online Book System version 1.0, which originates from a lack of validation of externally entered SQL statements in the ID parameter of the /description.php file. An attacker can exploit this vulnerability to...

Complete Online Beauty Parlor Management System /admin-profile.php File SQL Injection Vulnerability

Complete Online Beauty Parlor Management System is an online beauty parlor management system. The Complete Online Beauty Parlor Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the adminname parameter of...

Complete Online Beauty Parlor Management System /edit-services.php File SQL Injection Vulnerability

Complete Online Beauty Parlor Management System is an online beauty parlor management system. The Complete Online Beauty Parlor Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the editid parameter of th...

Sentrifugo bunitname parameter SQL injection vulnerability

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A SQL injection vulnerability exists in Sentrifugo version 3.2, which originates from the lack of validation of...

Sentrifugo sort_name Parameter SQL Injection Vulnerability

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A SQL injection vulnerability exists in Sentrifugo version 3.2, which originates from the lack of validation of...

Complete Online Beauty Parlor Management System /contact-us.php File SQL Injection Vulnerability

Complete Online Beauty Parlor Management System is an online beauty parlor management system. The Complete Online Beauty Parlor Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally-entered SQL statements in the email parameter of the...

Complete Online Beauty Parlor Management System /forgot-password.php File SQL Injection Vulnerability

Complete Online Beauty Parlor Management System is an online beauty parlor management system. The Complete Online Beauty Parlor Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the email parameter of the...

PT-2024-23278

Name of the Vulnerable Software and Affected Versions Exclusive Addons Elementor versions through 2.6.9 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

Hackers Hijack GitHub Accounts in Supply Chain Attack Affecting Top-gg and Others

Unidentified adversaries orchestrated a sophisticated attack campaign that has impacted several individual developers as well as the GitHub organization account associated with Top.gg, a Discord bot discovery site. "The threat actors used multiple TTPs in this attack, including account takeover v...

Unveiling BunnyLoader 3.0 Enhanced Malware Capabilities

Summary: BunnyLoader 3.0, which has been active since September 2023, is a malicious malware variant known for its enhanced data theft and advanced keylogging capabilities. This modular malware provides attackers with flexibility and presents challenges in terms of detection. Despite its global...

CVE-2024-29878

Cross-Site Scripting XSS vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...

CVE-2024-29878

Vulnerability: CVE-2024-29878 affects Sentrifugo 3.2. The XSS is in the description parameter of /sentrifugo/index.php/sitepreference/add. An attacker can craft a URL to execute arbitrary script in the victim’s browser and steal session data. Root cause: insufficient input validation/escaping for...

CVE-2024-29877 Cross-Site Scripting (XSS) vulnerability in Sentrifugo

Cross-Site Scripting XSS vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/expenses/expensecategories/edit, 'expensecategoryname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...

AndroxGh0st Malware Targets Laravel Apps to Steal Cloud Credentials

Cybersecurity researchers have shed light on a tool referred to as AndroxGh0st that's used to target Laravel applications and steal sensitive data. "It works by scanning and taking out important information from .env files, revealing login details linked to AWS and Twilio," Juniper Threat Labs...

Sentrifugo SQL注入漏洞

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A SQL injection vulnerability exists in Sentrifugo version 3.2, which stems from a missing id parameter in the...

CVE-2024-29878: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data...

Sentrifugo 安全漏洞

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A SQL injection vulnerability exists in Sentrifugo version 3.2, which originates from the lack of validation of...