CVE-2018-16809

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and valueunit...

CVE-2018-16808

An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter, or a public or private note...

CVE-2018-16809

An issue was discovered in Dolibarr through 7.0.0. expensereport/card.php in the expense reports module allows SQL injection via the integer parameters qty and valueunit...

CVE-2018-16809

Dolibarr up to 7.0.0: the expense reports module (expensereport/card.php) is vulnerable to SQL injection via integer parameters qty and value_unit due to insufficient input validation. Root cause described as an injectable SQL path in that file; impact per CVE notes is high, with a NVD CVSS v3 ba...

Joomla! vAccount 2.0.2 SQL Injection

Exploit Title: Joomla! Component vAccount 2.0.2 - SQL Injection Dork: N/A Date: 2019-01-23 Exploit Author: Ihsan Sencan Vendor Homepage: http://wdmtech.com/ Software Link: https://extensions.joomla.org/extensions/extension/financial/cost-calculators/vaccount/ Version: 2.0.2 Category: Webapps Test...

Joomla! Component vAccount 2.0.2 - 'vid' SQL Injection

Exploit Title: Joomla! Component vAccount 2.0.2 - SQL Injection Dork: N/A Date: 2019-01-23 Exploit Author: Ihsan Sencan Vendor Homepage: http://wdmtech.com/ Software Link: https://extensions.joomla.org/extensions/extension/financial/cost-calculators/vaccount/ Version: 2.0.2 Category: Webapps Test...

Weblogic Deserialization, Override Access Vulnerability in Zhejiang Insurance Expense Reimbursement System

CR Nebula is an innovative technology company that pioneered the use of mobile internet technology and experience to "elevate" enterprise-level financial management. A weblogic deserialization, override access vulnerability exists in the Zhejiang Insurance Expense Reimbursement System, which can ...

Expense Management 1.0 - Arbitrary File Upload

Expense Management 1.0 - Arbitrary File Upload Exploit Title: Expense Management 1.0 - Arbitrary File Upload Dork: N/A Date: 2018-10-30 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.webprojectbuilder.com/item/expense-management Software Link:...

Time And Expense Management System 3.0 SQL Injection

Exploit Title: Time and Expense Management System 3.0 - 'table' SQL Injection Dork: N/A Date: 2018-10-17 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.initechs.com/ Software Link: http://sourceforge.net/projects/tems/files/latest Version: 3.0 Category: Webapps Tested on:...

Time And Expense Management System 3.0 Cross Site Request Forgery

Exploit Title: Time and Expense Management System 3.0 - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-17 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.initechs.com/ Software Link: http://sourceforge.net/projects/tems/files/latest Version: 3.0 Category: Webapps Tested on:...

Time and Expense Management System 3.0 - table SQL Injection

Time and Expense Management System 3.0 - table SQL Injection Exploit Title: Time and Expense Management System 3.0 - 'table' SQL Injection Dork: N/A Date: 2018-10-17 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.initechs.com/ Software Link:...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01399)

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited to conduct a cross-site scripting attack via the expensename parameter in the...

Cross site request forgery (csrf)

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

CVE-2017-17991

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

CVE-2017-17991

Biometric Shift Employee Management System has XSS via the expensename parameter in an index.php?user=expenses request...

Mavenlink: Information disclosure when trying to delete an expense's attachment on m.mavenlink.com

There was an information disclosure vulnerability in a particular error message on the mobile site. Using this vulnerability, it was possible to gain access to the filename of certain un-owned attachments...

Expense Manager - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Expense Manager published at the 'play' market has multiple vulnerabilities...

AndroMoney ( Expense Track ) - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application AndroMoney Expense Track published at the 'play' market has multiple vulnerabilities...

MyMoney. Expense Manager - Dynamic Code Loading, External URLs, Runtime command execution vulnerabilities

HackApp vulnerability scanner discovered that application MyMoney. Expense Manager published at the 'play' market has multiple vulnerabilities...

Expense IQ Money Manager - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Expense IQ Money Manager published at the 'play' market has multiple vulnerabilities...