HTTP Response Splitting

kallithea is vulnerable to HTTP Response Splitting. It is possible because it does not escape the user-provided input from GET 'camefrom' parameter in the login instance, allowing an attacker to inject malicious HTTP headers to control the remaining headers and body of the response of the...

Craft CMS 3 vCard 1.0.0 Remote Code Execution

Exploit Title: CraftCMS 3 vCard Plugin 1.0.0 - Remote Code Execution Date: 2020-05-18 Exploit Author: Wade Guest Vendor Homepage: https://craftcms.com/ Software Link: https://plugins.craftcms.com/vcard Vulnerability Details: https://gitlab.com/wguest/craftcms-vcard-exploit Version: 1.0.0 Tested o...

Victor CMS 1.0 - (cat_id) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Victor CMS 1.0 - 'catid' SQL Injection Exploit Author: Kishan Lal Choudhary Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: 1.0 Tested o...

Victor CMS 1.0 SQL Injection

Exploit Title: Victor CMS 1.0 - 'catid' SQL Injection Google Dork: N/A Date: 2020-05-19 Exploit Author: Kishan Lal Choudhary Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: 1.0 Tested on: Windows 10...

Victor CMS 1.0 - 'cat_id' SQL Injection

Exploit Title: Victor CMS 1.0 - 'catid' SQL Injection Google Dork: N/A Date: 2020-05-19 Exploit Author: Kishan Lal Choudhary Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: 1.0 Tested on: Windows 10...

Cross site scripting

rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php...

CVE-2020-12259

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php...

Mail.ru: Reflected XSS

Reflected XSS in target.my.com/ via URI GET parameter...

CVE-2020-11530

A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to getscript/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user...

School ERP Pro 1.0 - (es_messagesid) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: School ERP Pro 1.0 - 'esmessagesid' SQL Injection Author: Besim ALTINOK Vendor Homepage: http://arox.in Software Link: https://sourceforge.net/projects/school-erp-ultimate/ Version: latest version Tested on: Xampp Credit: İsmail...

Open redirect

An Open Redirect vulnerability was discovered in Revive Adserver version 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/www/admin/-modify.php...

Mail.ru: Stored xss on https://go.mail.ru/

Reflected XSS via GET parameter in go.mail.ru...

Mail.ru: o2.mail.ru XSS

Reflected XSS in o2.mail.ru via GET parameter state...

Mail.ru: SQL Injection [unauthenticated] with direct output at https://news.mail.ru/

Unsafe usage of GET parameter led to SQL injection in news.mail.ru...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18324)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/edit-category.php in Chadha PHPKB Standard Multi-Language version 9...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18325)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9. The...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18328)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A stored cross-site scripting vulnerability exists in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9. An attack...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18327)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/edit-field.php in Chadha PHPKB Standard Multi-Language 9. The...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18338)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/manage-tickets.php in Chadha PHPKB Standard Multi-Language 9. The...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18333)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9. The...