CVE-2020-10467

Reflected XSS in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...

CVE-2020-10465

Reflected XSS in admin/edit-category.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...

CVE-2020-10463

CVE-2020-10463 affects Chadha PHPKB Standard Multi-Language v9. It is a reflected XSS in admin/edit-template.php via the GET parameter p, due to insufficient input sanitization. Impact described as ability to inject arbitrary web script/HTML; exploitation details or in-the-wild status not provide...

CVE-2020-10463

Reflected XSS in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...

CVE-2020-10462

Reflected XSS in admin/edit-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...

CVE-2020-10387

Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence ../ via the GET parameter file...

PT-2020-12132 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to inject arbitrary web script or HTML via the GET parameter p in the admin/edit-field.php file. This enables attackers to perform a Reflected XSS attack...

Mail.ru: turboslim.lady.mail.ru - Blind sql-injection.

Blind time based SQL injection in turboslim.lady.mail.ru promo page due to insecure use of GET parameter Уязвимость была в GET-параметре...

GHSA-PRG5-HG25-8GRQ Ability to switch channels via GET parameter enabled in production environments

Impact This vulnerability gives the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when %kernel.debug% is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value which is...

Ability to switch channels via GET parameter enabled in production environments

Impact This vulnerability gives the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when %kernel.debug% is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value which is...

CVE-2020-5218

Affected versions of Sylius give attackers the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value...

Mail.ru: [xss] passrestore на m/touch/tel

Reflected XSS in touch.mail.ru, m.mail.ru, light.mail.ru, tel.mail.ru via GET parameter error...

Hostel Management System 2.0 - id SQL Injection

Hostel Management System 2.0 - id SQL Injection Exploit Title: Hostel Management System 2.0 - 'id' SQL Injection Google Dork: intitle: "Hostel management system" Date: 2020-01-03 Exploit Author: FULLSHADE Vendor Homepage: https://phpgurukul.com Software Link:...

Complaint Management System 4.0 - (cid) SQL injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Complaint Management System 4.0 - 'cid' SQL injection Exploit Author: FULLSHADE Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/complaint-management-sytem/ Version: v4.0 Tested on: Windows 7 CVE : N...

IBM InfoPrint 4247-Z03 Impact Matrix Printer Directory Traversal

Exploit Title: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal Date: 2020-01-01 Exploit Author: Raif Berkay Dincel Vendor Homepage: ibm.com Software https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?subtype=ca&infotype=an&appname=iSource&supplier=897&letternum=ENUS107-295...

IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal

IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal Exploit Title: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal Date: 2020-01-01 Exploit Author: Raif Berkay Dincel Vendor Homepage: ibm.com Software...

IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal Vulnerability

Exploit for hardware platform in category web applications Exploit Title: IBM InfoPrint 4247-Z03 Impact Matrix Printer - Directory Traversal Exploit Author: Raif Berkay Dincel Vendor Homepage: ibm.com Software...

ManageEngine Desktop Central - FileStorage getChartImage Deserialization Unauthenticated Remote Code Execution

ManageEngine Desktop Central - FileStorage getChartImage Deserialization Unauthenticated Remote Code Execution !/usr/bin/python3 """ ManageEngine Desktop Central FileStorage getChartImage Deserialization of Untrusted Data Remote Code Execution Vulnerability Download:...

Ffuf - Fast Web Fuzzer Written In Go

A fast web fuzzer written in Go. Heavily inspired by the great projects gobuster and wfuzz. Features Fast! Allows fuzzing of HTTP header values, POST data, and different parts of URL, including GET parameter names and values Silent mode -s for clean output that's easy to use in pipes to other...

PUBG: Reflected XSS in pubg.com

Summary: PUBG's main website https://www.pubg.com has an endpoint that is vulnerable to an injection vulnerability - namely a reflected injection of JavaScript, also known as Reflected Cross Site Scripting XSS. As per OWASP's definition: "Cross-Site Scripting XSS attacks are a type of injection, ...