CSZ CMS SQL Injection Vulnerability (CNVD-2022-30782)

CSZ CMS is a PHP-based open-source content management system CMS.A SQL injection vulnerability exists in CSZ CMS 1.2.9, which can be exploited by attackers via cszcms/controllers/Member.php...

Jenkins Tests Selector Plugin Arbitrary File Read Vulnerability

Jenkins and Jenkins Plugin are both open source products from Jenkins.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Tests Selector Plugin 1.3.3 a...

Wordpress Plugin All-in-one Floating Contact Form Cross-Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. wordpress Plugin All-in-one Floating Contact Form...

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly...

Vmware Spring Framework Denial of Service Vulnerability

Vmware Spring Framework is a set of open source Java, JavaEE application framework from Vmware USA. The framework helps developers build high-quality applications.Vmware Spring Framework has a denial-of-service vulnerability that can be exploited by attackers to cause a denial of service via a...

CVE-2022-22274

creationtimestamp| type| source ---|---|--- 2022-03-29 11:35:50+00:00| seen| https://t.me/truesecator/2781 2022-03-29 12:52:24+00:00| seen| https://t.me/informationsecuritychannel/46999 2023-01-15 14:05:50+00:00| published-proof-of-concept| https://t.me/crackcodes/2272 2024-01-16 10:54:08+00:00|...

NETGEAR R8500 Command Injection Vulnerability

The NETGEAR R8500 is a wireless router from the American company Netgear. A security vulnerability exists in the NETGEAR R8500, which can be exploited by an attacker to execute arbitrary commands e.g. telnetd via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters of...

Directory traversal

An Archive Extraction AKA "Zip Slip vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal...

Analyzing the Attack Landscape: Rapid7’s 2021 Vulnerability Intelligence Report

Every year, our research team at Rapid7 analyzes thousands of vulnerabilities to understand root causes, dispel misconceptions, and explain why some flaws are more likely to be exploited than others. By continuously reviewing the vulnerability landscape and sharing our research team’s insights, w...

CISA Adds 32 Known Exploited Vulnerabilities to Catalog

CISA has added 32 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...

Covid-19 Directory On Vaccination System 1.0 SQL Injection

Exploit Title: Covid-19 Directory on Vaccination System 1.0 - SQLi Authentication Bypass Date: 28/03/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

CVE-2022-25523

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...

CVE-2022-25523

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...

CVE-2021-44462

This vulnerability can be exploited by parsing maliciously crafted project files with Horner Automation Cscape EnvisionRV v4.50.3.1 and prior. The issues result from the lack of proper validation of user-supplied data, which can result in reads and writes past the end of allocated data structures...

CISA Adds 66 Known Exploited Vulnerabilities to Catalog

CISA has added 66 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added...

D-Link DIR-816 A2 Command Injection Vulnerability

D-Link DIR-816 A2 is a wireless router from D-Link, Taiwan, China. D-Link DIR-816 A2 1.10 B05 is vulnerable to command injection, which can be exploited by attackers to arbitrarily reset the device to /goform/form2Reboot.cgi via the crafted tokenid parameter...

CVE-2020-20093

creationtimestamp| type| source ---|---|--- 2022-03-24 01:29:14+00:00| seen| https://t.me/cibsecurity/39473 2022-03-26 16:50:20+00:00| published-proof-of-concept| https://t.me/cKure/9181 2022-03-28 17:01:00+00:00| exploited| https://t.me/truesecator/2779 2022-03-28 19:02:41+00:00| exploited|...

CVE-2020-20094

creationtimestamp| type| source ---|---|--- 2022-03-24 01:29:07+00:00| seen| https://t.me/cibsecurity/39468 2022-03-28 17:01:00+00:00| exploited| https://t.me/truesecator/2779 2022-03-28 19:02:41+00:00| exploited| https://t.me/SEReborn/2017 2022-03-29 11:01:01+00:00| published-proof-of-concept|...

CVE-2020-20095

creationtimestamp| type| source ---|---|--- 2022-03-24 01:28:57+00:00| seen| https://t.me/cibsecurity/39462 2022-03-28 17:01:00+00:00| exploited| https://t.me/truesecator/2779 2022-03-28 19:02:41+00:00| exploited| https://t.me/SEReborn/2017 2022-03-29 11:01:01+00:00| published-proof-of-concept|...

ImpressCMS SQL Injection Vulnerability (CNVD-2022-30802)

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS is vulnerable to a SQL injection vulnerability that stems from insufficient cleaning of user data passed in the groupps parameter of the...