Egavilan Media Expense Management System 跨站脚本漏洞

Egavilan Media Expense Management System is a Php-based management system for logging overhead from Egavilan Media, USA. A cross-site scripting vulnerability exists in the EGavilan Media Expense Management System version 1.0, which can be exploited to permanently store malicious JavaScript code i...

Expense Management System - 'description' Stored Cross Site Scripting

Exploit Title: Expense Management System - 'description' Stored Cross Site Scripting Date: 02/12/2020 Exploit Author: Nikhil Kumar Vendor Homepage: http://egavilanmedia.com/ Software Link: http://egavilanmedia.com/expense-management-system/ Tested On: Ubuntu Vunerable Parameter: "description="...

Daily Expenses Management System 1.0 SQL Injection

Exploit Title: Daily Expenses Management System 1.0 - Multiple SQL Injection Vulnerabilty Date: 2020-8-5 Exploit Author: Edo Maland Vendor Homepage: https://www.sourcecodester.com/php/14372/daily-tracker-system-phpmysql.html Software Link:...

Sentrifugo CMS 3.2 Cross Site Scripting

Document Title: =============== Sentrifugo v3.2 CMS - Persistent XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2229 Release Date: ============= 2020-05-05 Vulnerability Laboratory ID VL-ID: ==================================== 22...

Sentrifugo v3.2 CMS - Persistent XSS Web Vulnerability

Document Title: =============== Sentrifugo v3.2 CMS - Persistent XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2229 Release Date: ============= 2020-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 22...

CVE-2020-10107

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCost parameter in manage-expense.php...

CVE-2020-10106

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to SQL injection, as demonstrated by the email parameter in index.php or register.php. The SQL injection allows to dump the MySQL database and to bypass the login prompt...

CVE-2020-10107

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCost parameter in manage-expense.php...

Sql injection

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to SQL injection, as demonstrated by the email parameter in index.php or register.php. The SQL injection allows to dump the MySQL database and to bypass the login prompt...

Cross site scripting

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCost parameter in manage-expense.php...

CVE-2020-10107

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCost parameter in manage-expense.php...

CVE-2020-10107

CVE-2020-10107: PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, evidenced by the ExpenseItem and ExpenseCost parameters within manage-expense.php. The Red Hat and NVD records corroborate a stored XSS issue affecting this application. No exploitation routes, affected versi...

CVE-2020-10106

CVE-2020-10106 affects PHPGurukul Daily Expense Tracker System 1.0. The Red Hat/NVD entries confirm a SQL injection via the email parameter in index.php or register.php, enabling dumping of the MySQL database and bypassing the login prompt. The vulnerability is driven by improper handling of user...

CVE-2020-10107: Improper Neutralization of Input During Web Page Generation

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS, as demonstrated by the ExpenseItem or ExpenseCost parameter in manage-expense.php...

CVE-2020-10106: Improper Neutralization of Special Elements used in an SQL Command

PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to SQL injection, as demonstrated by the email parameter in index.php or register.php. The SQL injection allows to dump the MySQL database and to bypass the login prompt...

The vulnerability of the Web Time and Expense interface of the integrated enterprise management system Microsoft Dynamics NAV allows a malicious individual to gain unauthorized access to arbitrary reports.

The vulnerability of the Web Time and Expense interface of the integrated enterprise management system Microsoft Dynamics NAV is related to the insecure direct object reference IDOR. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to arbitrar...

CVE-2019-19616

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

CVE-2019-19616

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...

CVE-2019-19616

CVE-2019-19616 concerns an insecure direct object reference in the Xtivia Web Time and Expense (WebTE) interface for Microsoft Dynamics NAV prior to 2017. The vulnerability occurs in the /Home/GetAttachment function, where an attacker can download arbitrary files by supplying arbitrary values for...

CVE-2019-19616: Authorization Bypass Through User-Controlled Key

An Insecure Direct Object Reference IDOR vulnerability in the Xtivia Web Time and Expense WebTE interface used for Microsoft Dynamics NAV before 2017 allows an attacker to download arbitrary files by specifying arbitrary values for the recId and filename parameters of the /Home/GetAttachment...