1213 matches found
CVE-2019-11567
An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $GET'del', as demonstrated by an admin/page/system/nav.php?del= URI...
XooDigital SQL Injection
Exploit Title: XooDigital - 'p' SQL Injection Date: 26.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://xooscripts.com/product/digital-download-protection-script.html Demo Site: http://xooscripts.com/demos/xoodigital/ Version: Lastest Tested on: Kali Linux CVE: N/A ----- PoC :...
Zeeways Jobsite CMS - id SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Zeeways Jobsite CMS - 'id' SQL Injection Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: http://www.zeeways.com/jobsite-cms/1/productdetail Demo Site: http://www.zeewayscms.com/jobsite/ Version: Lastest Tested on: Kali Linux...
Inout Article Base CMS - SQL Injection
Inout Article Base CMS - SQL Injection Exploit Title: Inout Article Base CMS - SQL Injection Date: 21.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.inoutscripts.com/products/inout-article-base/ Demo Site: http://www.inoutwebportal.com Version: Lastest Tested on: Kali Linu...
Inout Article Base CMS - SQL Injection
Exploit Title: Inout Article Base CMS - SQL Injection Date: 21.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.inoutscripts.com/products/inout-article-base/ Demo Site: http://www.inoutwebportal.com Version: Lastest Tested on: Kali Linux CVE: N/A ----- PoC 1: SQLi -----...
Cross site scripting
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is related to...
Mail.ru: Reflected XSS in https://light.mail.ru/login via page
Reflected XSS via GET parameter in light.mail.ru...
KeyBase Botnet v1.5 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: KeyBase Botnet v1.5 - SQL Injection Vulnerability Google Dork: intitle:"KeyBase: Login" + intext:" Login to get access to your logs " Date: 3/12/2018 Exploit Author: n4pst3r Vendor Homepage: unkn0wn Software Link: unkn0wn Versio...
FreeBSD : moodle -- multiple vulnerabilities (074cb225-bb2d-11e8-90e1-fcaa147e860e)
moodle reports : Moodle XML import of ddwtos could lead to intentional remote code execution QuickForm library remote code vulnerability upstream Boost theme - blog search GET parameter insufficiently filtered C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...
IBM: Reflected XSS and Blind out of band command injection at subdomain dstuid-ww.dst.ibm.com
I found an XSS and Blind OS based injection issue due to the incorrect handling of the characters in THE EMAIL get& post parameters. A injected and a sleep command succesfully executed, the following link works as a PoC that alerts the string in the script: I reproduced the same on Firefox and IE...
Mail.ru: Blind SQL injection [https://honor.hi-tech.mail.ru]
Blind boolean based SQLi in honor.hi-tech.mail.ru due to insecure use of GET parameter. Extended scope was not covered by bug bounty on the moment of reporting, the bounty was issued as a bonus...
CVE-2018-1000642
FlightAirMap version =v1.0-beta.21 contains a Cross Site Scripting XSS vulnerability in GET variable used within registration sub menu page that can result in unauthorised actions and access to data, stealing session information. This vulnerability appears to have been fixed in after commit 22b09...
CVE-2018-1000640
OpenCart-Overclocked version =1.11.1 contains a Cross Site Scripting XSS vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of service. This attack appear to be...
CVE-2018-1000640
OpenCart-Overclocked version =1.11.1 contains a Cross Site Scripting XSS vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of service. This attack appear to be...
Cross site scripting
OpenCart-Overclocked version =1.11.1 contains a Cross Site Scripting XSS vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of service. This attack appear to be...
CVE-2018-1000640
OpenCart-Overclocked (
ShopsN open source online store full web system suffers from SQL injection vulnerability (CNVD-2018-17332)
ShopsN free version of the B2C e-commerce is a product of Shanghai Yisu Network Technology Co., Ltd. a full-featured enterprise-class commercial standards in line with the real allow free commercial use of open source online store full network system. ShopsN v2.3.3 official version of the existen...
ShopsN open source online store full network system SQL injection vulnerabilities exist
ShopsN free version of the B2C e-commerce is a product of Shanghai Yisu Network Technology Co., Ltd. a full-featured enterprise-class commercial standards in line with the real allow free commercial use of open source online store full network system. ShopsN v2.3.3 official version of the existen...
LAMS 3.1 - Cross-Site Scripting
LAMS 3.1 - Cross-Site Scripting Exploit Title: LAMS 3.1 - Cross-Site Scripting Date: 2018-08-05 Exploit Author: Nikola Kojic Website: https://ras-it.rs/ Vendor Homepage: https://www.lamsfoundation.org/ Software Link: https://www.lamsfoundation.org/downloadshome.htm Category: Web Application...
