Schools Alert Management Script - Arbitrary File Read Detection

Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f parameter in img.php, aka absolute path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Schools Alert Management Script is susceptible to an arbitrary file read vulnerability via the f paramet...

aprim2014.org XSS vulnerability

Open Bug Bounty ID: OBB-631333 Description| Value ---|--- Affected Website:| aprim2014.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ombullies.com XSS vulnerability

Open Bug Bounty ID: OBB-631243 Description| Value ---|--- Affected Website:| ombullies.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Schools Alert Management Script Absolute Path Traversal Vulnerability

Schools Alert Management Script is a set of school management system scripts. An absolute path traversal vulnerability exists in PHP Scripts Mall Schools Alert Management Script. The vulnerability can be exploited to read arbitrary files via the f parameter in img.php...

CVE-2018-12054

Summary (CVE-2018-12054): The Schools Alert Management Script is vulnerable to an arbitrary file read via the f parameter in img.php (absolute path traversal). Exploitation PoC shows /img.php?f=/./etc/./passwd, enabling read of sensitive local files. Affected software: PHP Scripts Mall Schools Al...

CVE-2018-12054

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

CVE-2018-12054: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

PT-2018-10974

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script affected versions not specified Description The issue allows for Arbitrary File Deletion via the img parameter in the "delete img.php" endpoint by utilizing directory traversal. Recommendations...

PT-2018-10975

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Schools Alert Management Script affected versions not specified Description The issue allows for Arbitrary File Read via the f parameter in the "img.php" endpoint. This is achieved through absolute path traversal, enabling...

berezovskii.ru XSS vulnerability

Open Bug Bounty ID: OBB-618478 Description| Value ---|--- Affected Website:| berezovskii.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

tuhtin.ru XSS vulnerability

Open Bug Bounty ID: OBB-618475 Description| Value ---|--- Affected Website:| tuhtin.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bruidstaartspecialist.nl XSS vulnerability

Open Bug Bounty ID: OBB-568030 Description| Value ---|--- Affected Website:| bruidstaartspecialist.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

im-sexy.fr XSS vulnerability

Open Bug Bounty ID: OBB-568008 Description| Value ---|--- Affected Website:| im-sexy.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-4880

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.3 Description The issue allows remote authenticated users to execute arbitrary OS commands. This is achieved by including a '|' character in the graph parameter of the status rrd graph img.php file, which is related...

robak.linuxpl.info XSS vulnerability

Vulnerable URL: http://robak.linuxpl.info/img.php?img=%22/%3E%3Cscript%3Ealert/OPENBUGBOUNTY/;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

summilux.net XSS vulnerability

Vulnerable URL: http://www.summilux.net/notes/vario-img.php?url=%22/%3E%3Cscript%3Ealert/OPENBUGBOUNTY/;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 03.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 443195 VIP...

PT-2015-3613

Name of the Vulnerable Software and Affected Versions Joomlaskin JS Multi Hotel plugin versions 2.2.1 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the path parameter ...

PT-2014-6054

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.1.4 Description The issue allows remote authenticated users to execute arbitrary commands. This can be achieved through various means, including the hostname value to "diag dns.php" in a Create Alias action, the...

WordPress Profiles 2.0 RC1 SQL Injection

Exploit Title: WordPress Profiles plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- $query = "SELECT FROM ".$wpdb-prefix."bios WHERE id='$GETid'"; ... $result = mysqlquery$query;...

WordPress Plugin Profiles 2.0 RC1 - SQL Injection

Exploit Title: WordPress Profiles plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- $query = "SELECT FROM ".$wpdb-prefix."bios WHERE id='$GETid'"; ... $result = mysqlquery$query;...