Motorola WR850G 4.03 Credentials

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Motorola WR850G v4.03 Credentials', 'Description' = %q Login credentials to the Motorola WR850G router with firmware v4.03 can be obtained via a...

WordPress Shield Security 20.0.5 Cross Site Scripting

Exploit Title: CVE-2024-7313 - Reflected XSS to Unauthorised Administrator Account Creation Google Dork: inurl:"/wp-content/plugins/wp-simple-firewall/" Cannot find version numbers from this DORK Date: 16/08/2024 Exploit Author: Tim Lepp Vendor Homepage: https://getshieldsecurity.com/ Software...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...

PT-2024-29475 · Unknown · Aml Surety Eco

Name of the Vulnerable Software and Affected Versions: AML Surety Eco versions up to 3.5 Description: The issue allows an attacker to run arbitrary code via a crafted GET request using the id parameter. This is a Cross Site Scripting XSS issue. Recommendations: For AML Surety Eco versions up to...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...

AML Surety Eco 安全漏洞

AML Surety Eco is an end-to-end BSA/AML ecosystem from AML. A security vulnerability exists in AML Surety Eco version 3.5 and earlier, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to run arbitrary code via a specially crafted GET request...

CVE-2024-41640

Cross Site Scripting XSS vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter...

CVE-2024-39304 ChurchCRM SQL Injection Vulnerability

ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQ...

CVE-2024-6746

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...

CVE-2024-6746 NaiboWang EasySpider HTTP GET Request server.js path traversal

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...

CVE-2024-6746 NaiboWang EasySpider HTTP GET Request server.js path traversal

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...

CVE-2024-6746 NaiboWang EasySpider HTTP GET Request server.js path traversal

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...

CVE-2024-6746

NaiboWang EasySpider 0.6.2 on Windows has a path-traversal vulnerability in the HTTP GET Request Handler (server.js) that allows reading arbitrary Windows files via input like /../../../../../../../../../Windows/win.ini. Exploitation is possible within a local network, and public disclosure has o...

BIT-MEDIAWIKI-2024-40603

An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request...

Fortinet FortiAIOps 跨站请求伪造漏洞

Fortinet FortiAIOps is a Fortinet networking solution that combines artificial intelligence and machine learning AI/ML from Fortinet. Fortinet FortiAIOps version 2.0.0 suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that...

CVE-2024-39063

Lime Survey = 6.5.12 is vulnerable to Cross Site Request Forgery CSRF. The YIICSRFTOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests...

CVE-2024-40603

An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request...

MediaWiki 安全漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. MediaWiki has a security vulnerability that stems from the presence of cross-site request forgery CSRF,...

CVE-2024-40603

An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request...

CVE-2024-40603

CVE-2024-40603 affects the MediaWiki ArticleRatings extension up to 1.42.1. The vulnerability is in Special:ChangeRating, where CSRF can alter data via a GET request. Underlying cause: CSRF weakness in the GET-based operation. Impact: data modification is possible, with CVSS 3.1 base score 4.3 (M...