BigTree CMS 4.2.23 Cross Site Scripting

Exploit Title: BigTree CMS 4.2.23 - Cross-Site Scripting Date: 2018-10-15 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.bigtreecms.org/ Software Link : https://github.com/bigtreecms/BigTree-CMS/ Software : BigTree CMS Version : 4.2.23 Vulernability Type : Cross-site Scripting...

Code Execution Vulnerability in YCCMS

YCCMS is a version of PHP5 + MYSQL as the technical basis for the development of lightweight CMS station-building system. A code execution vulnerability exists in YCCMS v3.3. The vulnerability stems from the failure to strictly filter the type of uploaded images, which can be exploited by attacke...

Cisco IOS XE Software Digital Signature Authentication Bypass Vulnerability

Cisco IOS XE Software is an operating system developed by Cisco for its network devices. A digital signature verification bypass vulnerability exists in the Image Verification feature of Cisco IOS XE Software, which arises from a failure of the affected software to properly verify the electronic...

Chaturbate: [chaturbate.com] - CSRF Vulnerability on image upload

Summary Hi guys, One of the features available to a Chaturbate user is the ability to upload images into photo sets. The upload functionality does not use any CSRF tokens, allowing attackers to perform CSRF attacks and upload images to a user's profile without the user's consent. Steps To...

UltimatePOS 2.5 - Remote Code Execution

Exploit Title: UltimatePOS 2.5 - Remote Code Execution Google Dork: intext:"UltimatePOS" Date: 2018-08-22 Exploit Author: Renos Nikolaou Vendor Homepage: http://ultimatefosters.com/ Software Link: https://codecanyon.net/item/saas-superadmin-module-for-ultimatepos-advance/22394431 Version: 2.5...

KingMedia 4.1 Remote Code Execution

Exploit Title: KingMedia 4.1 - Remote Code Execution Author: Efren Diaz Exploit Date: 2018-08-15 Software: KingMedia Version: 1.x, 2.x, 3.x, 4.1 Link: https://codecanyon.net/item/king-media-video-image-upload-and-share/7877877 CVE: N/A \n\n"; echo " -target: http://site.com/... required\n"; echo ...

KingMedia 4.1 - File Upload

KingMedia 4.1 - File Upload Exploit Title: KingMedia 4.1 - Remote Code Execution Author: Efren Diaz Exploit Date: 2018-08-15 Software: KingMedia Version: 1.x, 2.x, 3.x, 4.1 Link: https://codecanyon.net/item/king-media-video-image-upload-and-share/7877877 CVE: N/A \n\n"; echo " -target:...

KingMedia 4.1 - File Upload

Exploit Title: KingMedia 4.1 - Remote Code Execution Author: Efren Diaz Exploit Date: 2018-08-15 Software: KingMedia Version: 1.x, 2.x, 3.x, 4.1 Link: https://codecanyon.net/item/king-media-video-image-upload-and-share/7877877 CVE: N/A \n\n"; echo " -target: http://site.com/... required\n"; echo ...

OpenEMR Unrestricted File Upload Vulnerability

OpenEMR is a medical practice management software that also supports electronic medical records EMR. An unrestricted file upload vulnerability exists in interface/super/managesitefiles.php in versions of OpenEMR prior to 5.0.1.4, which can be exploited by a remote attacker who uploads a PHP file...

Red Hat VDSM Denial of Service Vulnerability

Red Hat Ovirt is an open source virtualization management platform from Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of an ovirt-node client and an overt-engine manager. vdsm is a virtual desktop server manager that facilitates communication between t...

ZZCMS Arbitrary File Deletion Vulnerability (CNVD-2018-12559)

ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in the /user/del.php file in ZZCMS version 8.3. The vulnerability can be exploited to delete arbitrary files by placing a relative path to the zzcmsmain form and sending a reque...

CVE-2018-0300

A vulnerability in the process of uploading new application images to Cisco FXOS on the Cisco Firepower 4100 Series Next-Generation Firewall NGFW and Firepower 9300 Security Appliance could allow an authenticated, remote attacker using path traversal techniques to create or overwrite arbitrary...

CVE-2018-11736

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file...

CVE-2018-11736

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file...

CVE-2018-7659

In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stored Cross-Site Scripting Vulnerability could potentially be exploited by malicious users to compromise the affected system via a filename of an uploaded image file...

Buddypress Xprofile Custom Fields Type 2.6.3 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: Plugin Buddypress Xprofile Custom Fields Type 2.6.3 RCE – Unlink Date: 08/04/2018 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/ Software Link:...

Vanno enterprise website management system (PHP version) cms_channel_add.php and channel.php file contains a file inclusion vulnerability

Vanno enterprise website management system PHP version is a php+MySQL development of php enterprise website management system. Vano enterprise website management system PHP version cmschanneladd.php and channel.php file contains a file inclusion vulnerability. The vulnerability is due to the...

Tiki PNG Cross-Site Scripting Vulnerability

Tiki is a suite of open source content management and portal applications from the Tiki software community that can be used to create web applications, portals, corporate intranets, extranets, and more. A cross-site scripting vulnerability exists in Tiki version 17.1 that stems from the program...

DRUPAL-CONTRIB-2018-014

This module enables you to drag and drop or paste images into CKEditor. The module does not sufficiently verify users permissions, which leads to anonymous users being able to upload files to the server...

CVE-2018-6943

core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails to properly sanitize user input passed to the $temp variable...