CVE-2016-10513

Cross Site Scripting XSS exists in Piwigo before 2.8.3 via a crafted search expression to include/functionssearch.inc.php...

CVE-2017-15194

include/globalsession.php in Cacti 1.1.25 has XSS related to 1 the URI or 2 the refresh page...

PT-2017-7911

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.8.3 Description The issue allows remote attackers to bypass intended access restrictions. This can be achieved via a URL that contains a " character, or a URL beginning with a substring other than the http:// or...

PT-2017-7910

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.8.3 Description A Cross Site Scripting XSS issue exists, allowing for the execution of malicious scripts via a crafted search expression. The issue is related to the include/functions search.inc.php file...

PT-2017-13887

Name of the Vulnerable Software and Affected Versions Cacti version 1.1.25 Description The issue is related to XSS in the include/global session.php file. This is due to the handling of 1 the URI or 2 the refresh page. Recommendations For Cacti version 1.1.25, update to a version that includes a...

PT-2017-18845

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions prior to 3.0.34 Description A Shell metacharacter injection issue in the /usr/www/include/ajax/GetTest.php file allows for remote code execution as root. Recommendations For versions prior to 3.0.34, update to version...

CVE-2017-14402

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...

CVE-2017-14402: Improper Neutralization of Special Elements used in an SQL Command

The EyesOfNetwork web interface aka eonweb 5.1-0 has SQL injection via the username parameter to module/adminuser/addmodifyuser.php in the "ACCOUNT CREATION" section, related to lack of input validation in include/function.php...

PT-2017-13445

Name of the Vulnerable Software and Affected Versions EyesOfNetwork web interface aka eonweb version 5.1-0 Description The issue is related to a lack of input validation in include/function.php, which allows SQL injection via the user name parameter to the "ACCOUNT CREATION" section in module/adm...

Directory traversal

PHP remote file inclusion vulnerability in the Gwolle Guestbook plugin before 1.5.4 for WordPress, when allowurlinclude is enabled, allows remote authenticated users to execute arbitrary PHP code via a URL in the abspath parameter to frontend/captcha/ajaxresponse.php. NOTE: this can also be...

Tulpar - Web Vulnerability Scanner

Tulpar is a open source web vulnerability scanner for written to make web penetration testing automated. Features Sql Injection GET Method XSS GET Method Crawl E-mail Disclosure Credit Card Disclosure Whois Command Injection GET Method Directory Traversal GET Method File Include GET Method Server...

PT-2017-12683

Name of the Vulnerable Software and Affected Versions Question2Answer versions prior to 1.7.5 Description The issue allows remote attackers to create multiple user accounts by exploiting a flaw in the qa-include/qa-install.php file. Recommendations For versions prior to 1.7.5, update to version...

CVE-2017-12775: Improper Input Validation

qa-include/qa-install.php in Question2Answer before 1.7.5 allows remote attackers to create multiple user accounts...

Wireless Repeater BE126 - Local File Inclusion

Exploit Title: WIFI Repeater BE126 – Local File Inclusion Date Publish: 23/08/2017 Exploit Authors: Hay Mizrachi, Omer Kaspi Contact: [email protected], [email protected] Vendor Homepage: http://www.twsz.com Category: Webapps Version: 1.0 Tested on: Windows/Ubuntu 16.04 CVE: CVE-2017-8770 1 -...

CVE-2017-12131: Improper Neutralization of Input During Web Page Generation

The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php, as demonstrated by the Default Testimonials Width, View More Testimonials Link, and Testimonial Excerpt Options screens...

PT-2017-12356

Name of the Vulnerable Software and Affected Versions Easy Testimonials plugin version 3.0.4 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is demonstrated through the Default Testimonials Width, View More Testimonials Link, and Testimonial...

PT-2017-19170

Name of the Vulnerable Software and Affected Versions MetInfo version 5.3.17 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the Client-IP or X-Forwarded-For HTTP header to the "/include/stat/stat.php" API endpoint in a para action...

CVE-2017-11347

Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php...

CVE-2017-11347: Undefined Security Weakness

Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php...

PT-2017-11948

Name of the Vulnerable Software and Affected Versions MetInfo version 5.3.17 Description The issue allows a remote authenticated attacker to execute code by generating a PHP script with the content of a malicious image. This is related to the files admin/include/common.inc.php and...