CVE-2018-18320: Undefined Security Weakness

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network, and intentionally allows remote co...

PizzaInn Beta 3 specials-exec.php Shell Upload

Exploit Title :----------------- : PizzaInn Restaurant Scripti Beta v3 - specials-exec.php - Shell Upload. Author :------------------------ : Nassim Asrir Author Company :------------------------ : HenceForth Author Email :------------------------ : [email protected] Google Dork :---------------...

PizzaInn Beta 3 categories-exec.php Cross Site Request Forgery

Exploit Title :----------------- : PizzaInn Restaurant Scripti Beta v3 - categories-exec.php - CSRF Add Category Author :------------------------ : Nassim Asrir Author Company :------------------------ : HenceForth Author Email :------------------------ : [email protected] Google Dork...

CVE-2014-6619

Multiple cross-site scripting XSS vulnerabilities in register-exec.php in Restaurant Script PizzaInnProject 1.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 fname, 2 lname, or 3 login parameter...

PT-2014-7303

Name of the Vulnerable Software and Affected Versions Restaurant Script PizzaInn Project version 1.0.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via the fname, lname, or login parameters in the register-exec.php file, potentially leading to cross-site...

CVE-2014-6619: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in register-exec.php in Restaurant Script PizzaInnProject 1.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 fname, 2 lname, or 3 login parameter...

CVE-2014-4687: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in pfSense before 2.1.4 allow remote attackers to inject arbitrary web script or HTML via 1 the starttime0 parameter to firewallschedule.php, 2 the rssfeed parameter to rss.widget.php, 3 the servicestatusfilter parameter to...

PizzaInn_Project - SQL Injection

No description provided by source. + Exploit: PizzaInnProject - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/restaurantmis/ 1 Sql Injection Time Based Blind PoC: http://127.0.0.1/reserve-exec.php?id=1' SQL...

PizzaInn_Project SQL Injection Vulnerability

Exploit for php platform in category web applications + Exploit: PizzaInnProject - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/restaurantmis/ 1 Sql Injection Time Based Blind PoC:...

PizzaInn_Project - SQL Injection

Exploit: PizzaInnProject - SQL Injection + Author: vinicius777 + Contact: vinicius777 AT gmail @vinicius777 + Vendor Homepage: http://sourceforge.net/projects/restaurantmis/ 1 Sql Injection Time Based Blind PoC: http://127.0.0.1/reserve-exec.php?id=1' SQL Injection Vulnerable Code: +...

Design/Logic Flaw

NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality b...

PT-2013-4530

Name of the Vulnerable Software and Affected Versions NAS4Free versions 9.1.0.1.804 and earlier Description The issue allows remote authenticated users to execute arbitrary PHP code via a request to "exec.php", which is part of the "Advanced | Execute Command" feature. It appears this might be...

CVE-2013-3631: Improper Control of Generation of Code

NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality b...

PT-2012-3884

Name of the Vulnerable Software and Affected Versions eGroupware versions prior to 1.8.004.20120405 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the menuaction parameter to "etemplate/process exec.php". Recommendations For version...

CVE-2006-0563: Undefined Security Weakness

SQL injection vulnerability in exec.php in PluggedOut Blog 1.9.9c allows remote attackers to execute arbitrary SQL commands via the entryid parameter in a commentadd action...

PluggedOut Blog SQL injection and XSS

PluggedOut Blog SQL INJECTION and XSS PluggedOut Blog is an open source script you can run on your web server to give you an online multi-user journal or diary. It can be used equally well for any kind of calendar application.Rather than give you a thousand things you don't really want...