CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-19889

DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcmspid=-70 can add a user...

CVE-2020-19889: Cross-Site Request Forgery (CSRF)

DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcmspid=-70 can add a user...

PT-2020-19198

Name of the Vulnerable Software and Affected Versions openSIS Community Edition version 7.3 Description The issue allows for SQL injection via the USERNAME parameter of the "index.php" endpoint. Recommendations For openSIS Community Edition version 7.3, avoid using the USERNAME parameter in the...

CVE-2020-6637: Improper Neutralization of Special Elements used in an SQL Command

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

PT-2020-15215

Name of the Vulnerable Software and Affected Versions DBHcms version 1.2.0 Description The issue concerns the lack of a CSRF protection mechanism. This can be demonstrated through a CSRF attack on the "index.php?dbhcms pid=-70" endpoint, which allows adding a user. Recommendations For DBHcms...

CVE-2020-15081 Information exposure in the upload directory in PrestaShop

In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory...

Cross site request forgery (csrf)

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

CVE-2020-13155

CVE-2020-13155 concerns a CSRF vulnerability in the NukeViet 4.4 product, where the request to CSRF via clearsystem.php can inject HTML when the deltype parameter is used in the URI admin/index.php?nv=webtools&op=clearsystem. The affected component is the clearsystem functionality in NukeViet 4.4...

CVE-2020-13155

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

PT-2020-13360

Name of the Vulnerable Software and Affected Versions NukeViet version 4.4 Description The issue allows for CSRF with resultant HTML injection via the deltype parameter to the "admin/index.php?nv=webtools&op=clearsystem" URI. This can be exploited through the clearsystem.php file. Recommendations...

CVE-2020-13156: Cross-Site Request Forgery (CSRF)

modules\users\admin\adduser.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=useradd URI...

CVE-2020-13155: Cross-Site Request Forgery (CSRF)

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

PT-2020-13362

Name of the Vulnerable Software and Affected Versions NukeViet version 4.4 Description The issue allows for a Cross-Site Request Forgery CSRF attack to change a user's password without needing the old password. This is achieved through the admin/index.php?nv=users&op=edit&userid= URI in the...

College-Management-System-Php 1.0 SQL Injection

Exploit Title: College-Management-System-Php 1.0 - Authentication Bypass / SQL Injection Exploit Author: BLAY ABU SAFIAN Inveteck Global Website: https://github.com/olotieno/College-Management-System-Php Date: 2020-06-16 Google Dork: N/A Vendor: https://github.com/olotieno/ Software Link:...

CVE-2020-13978: Improper Neutralization of Special Elements used in an OS Command

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=editchunk URI. NOTE: there is no indication that the Edit Chunk...

PT-2020-12440

Name of the Vulnerable Software and Affected Versions Centreon host-monitoring widget versions prior to 1.6.4, 18.10.3, 19.04.3, and 19.0.1 Centreon service-monitoring widget versions prior to 1.6.4, 18.10.5, 19.04.3, and 19.10.2 Centreon tactical-overview widget versions prior to 1.0.3, 18.10.1,...

CVE-2020-13384

Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...

PT-2020-13509

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is possible because the system blocks .php filenames but does not block filenames with certain extensions such as...

CVE-2020-13384: Unrestricted Upload of File with Dangerous Type

Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...