13405 matches found
PT-2020-13509
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is possible because the system blocks .php filenames but does not block filenames with certain extensions such as...
CVE-2020-13384: Unrestricted Upload of File with Dangerous Type
Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...
Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting
Exploit Title: Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting Dork: N/A Date: 2020-05-06 Exploit Author: Vulnerability-Lab Vendor: http://www.sentrifugo.com/ Link: http://www.sentrifugo.com/download Version: 3.2 Category: Webapps CVE: N/A Document Title: =============== Sentrifugo v3.2 CMS ...
Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Sentrifugo CMS 3.2 - Persistent Cross-Site Scripting Vendor: http://www.sentrifugo.com/ Link: http://www.sentrifugo.com/download Version: 3.2 Product & Service Introduction: ===============================...
CVE-2020-12765: Improper Limitation of a Pathname to a Restricted Directory
Solis Miolo 2.0 allows index.php?module=install&action=view&item= Directory Traversal...
PT-2020-13253
Name of the Vulnerable Software and Affected Versions Solis Miolo version 2.0 Description The issue allows for Directory Traversal via the "index.php?module=install&action=view&item=" endpoint. This could potentially allow an attacker to access sensitive files on the system. Recommendations For...
PT-2020-12667
Name of the Vulnerable Software and Affected Versions Chop Slider 3 affected versions not specified Description A blind SQL injection issue is present, allowing an attacker to execute arbitrary SQL queries in the context of the WP database user. The issue is introduced through the id GET paramete...
CVE-2020-11671
Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default...
PT-2020-12761
Name of the Vulnerable Software and Affected Versions TeamPass versions 2.1.27.36 and earlier Description The issue is related to a lack of authorization controls in REST API functions. This allows any TeamPass user with a valid API token to become a TeamPass administrator and read or modify all...
CVE-2020-11671: Missing Authorization
Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default...
Cross-site Scripting (XSS)
forkcms/forkcms is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape user input displayname value in the function loadDataGrid in Index.php allowing a malicious user to inject and execute malicious web script...
PT-2020-18369
Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.5.0.0 through 1.7.6.4 Description The issue is related to improper access control in PrestaShop, specifically affecting legacy controllers since version 1.5.0.0. The affected API endpoints include...
CVE-2020-11712
CVE-2020-11712 affects the Open Upload project (PHP-based file upload app) up to version 0.4.3. The issue is a Cross-Site Scripting (XSS) vulnerability exploitable via index.php?action=u and the filename field. The available sources state the vulnerability and affected version but do not provide ...
CVE-2020-11712: Improper Neutralization of Input During Web Page Generation
Open Upload through 0.4.3 allows XSS via index.php?action=u and the filename field...
PT-2020-12798
Name of the Vulnerable Software and Affected Versions Open Upload versions 0.4.3 and earlier Description The issue allows for XSS exploitation via the "index.php?action=u" endpoint, specifically through the filename field. This can lead to malicious script execution. Recommendations For Open Uplo...
PT-2020-12683
Name of the Vulnerable Software and Affected Versions Search Meter plugin versions through 2.13.2 Description The issue allows user input introduced in the search bar to be any formula, potentially leading to remote code execution via CSV injection if a specific export is performed, specifically...
fcnetwork.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1123653 Security Researcher securaji Helped patch 77 vulnerabilities Received 3 Coordinated Disclosure badges Received 4 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting fcnetwork.com website and it...
Joomla! com_hdwplayer 4.2 - search.php SQL Injection
Joomla! comhdwplayer 4.2 - search.php SQL Injection Exploit Title: Joomla! comhdwplayer 4.2 - 'search.php' SQL Injection Dork: inurl:"index.php?option=comhdwplayer" Date: 2020-03-23 Exploit Author: qw3rTyTy Vendor Homepage: https://www.hdwplayer.com/ Software Link:...
