CVE-2020-28129: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'...

PT-2020-16930

Name of the Vulnerable Software and Affected Versions SourceCodester Online Library Management System version 1.0 Description The issue allows remote code execution via the "admin/borrower/index.php?view=add" endpoint because .php files can be uploaded to "admin/borrower/photos" under the web roo...

CVE-2020-28130: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos under the web root...

CVE-2020-27191: Undefined Security Weakness

LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

PT-2020-16656

Name of the Vulnerable Software and Affected Versions LionWiki versions prior to 3.2.12 Description The issue allows an unauthenticated user to read files as the web server user via a crafted string in the f1 variable in index.php, also known as Local File Inclusion. This affects products that ar...

CVE-2020-28351

The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack via the PATHINFO to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page...

PT-2020-16993

Name of the Vulnerable Software and Affected Versions Mitel ShoreTel version 19.46.1802.0 Description The issue allows an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation for the time zone object in the HOME MEETING& page, specifically...

Exploit for Cross-site Scripting in Mitel Shoretel_Firmware

ShoreTel 19.46.1802.0 Reflected Cross Site Scripting Attack T...

Processwire CMS 2.4.0 Local File Inclusion

Exploit Title: Local File Inclusion Processwire CMS 2.4.0 Vulnerability Type: Unauthenticated LFI Date: 03.11.2020 Exploit Author: Y1LD1R1M Type: WEBAPPS Platform: PHP Vendor Homepage: https://processwire.com/ Version: 2.4.0 Tested on: Kali Linux Description Local File Inclusion in Processwire CM...

PT-2020-16879

Name of the Vulnerable Software and Affected Versions SourceCodester Car Rental Management System version 1.0 Description The issue allows remote code execution due to an arbitrary file upload vulnerability in the Upload Image component. This is possible because .php files can be uploaded to the...

CVE-2020-27956: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=managecar because .php files can be uploaded to admin/assets/uploads/ under the web root...

CVE-2020-26802: Cross-Site Request Forgery (CSRF)

forma.lms 2.3.0.2 is affected by Cross Site Request Forgery CSRF in formalms/appCore/index.php?r=lms/profile/show&ap=saveinfo via a GET request to change the admin email address in order to accomplish an account takeover...

PT-2020-16490

Name of the Vulnerable Software and Affected Versions forma.lms version 2.3.0.2 Description The issue allows for Cross Site Request Forgery CSRF in the "forma.lms" application, specifically in the "formalms/appCore/index.php" endpoint, when a GET request is made to...

CVE-2020-26042

An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php...

CVE-2020-26043

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php...

CVE-2020-26041

An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php...

CVE-2020-26043

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php...

Sql injection

An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php...

Cross site scripting

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php...

SpinetiX Fusion Digital Signage 3.4.8 File Backup/Delete Path Traversal

Summary At SpinetiX we inspire businesses to unlock the potential of their story. We believe in the power of digital signage as a dynamic new storytelling platform to engage with people. For more than 13 years, we have been constantly innovating to deliver cutting-edge digital signage solutions...