CVE-2019-1000024: Improper Neutralization of Input During Web Page Generation

OPT/NET BV NG-NetMS version v3.6-2 and earlier versions contains a Cross Site Scripting XSS vulnerability in /js/libs/jstree/demo/filebrowser/index.php page. The "id" and "operation" GET parameters can be used to inject arbitrary JavaScript which is returned in the page's response that can result...

CVE-2016-1000271: Improper Neutralization of Special Elements used in an SQL Command

Joomla extension DT Register version before 3.1.12 Joomla 3.x / 2.8.18 Joomla 2.5 contains an SQL injection in "/index.php?controller=calendar&format=raw&cat0=SQLi&task=events". This attack appears to be exploitable if the attacker can reach the web server...

PT-2019-11272

Name of the Vulnerable Software and Affected Versions: OPT/NET BV NG-NetMS versions v3.6-2 and earlier Description: The issue concerns a Cross Site Scripting XSS vulnerability. It affects the /js/libs/jstree/demo/filebrowser/index.php page, where the id and operation GET parameters can be used to...

CVE-2018-15517: Server-Side Request Forgery (SSRF)

The MailConnect feature on D-Link Central WiFiManager CWM-100 1.03 r0098 devices is intended to check a connection to an SMTP server but actually allows outbound TCP to any port on any IP address, leading to SSRF, as demonstrated by an index.php/System/MailConnect/host/127.0.0.1/port/22/secure/ U...

CVE-2019-6990

A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a crafted Zone NAME to the index.php?view=zones&action=zoneImage&mid=1 URI...

CVE-2019-6992

A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI...

CVE-2019-6992: Improper Neutralization of Input During Web Page Generation

A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI...

CVE-2019-6990: Improper Neutralization of Input During Web Page Generation

A stored-self XSS exists in web/skins/classic/views/zones.php of ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a crafted Zone NAME to the index.php?view=zones&action=zoneImage&mid=1 URI...

CVE-2019-6777

An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter...

CVE-2019-6777: Improper Neutralization of Input During Web Page Generation

An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter...

Joomla! Component VMap 1.9.6 - SQL Injection

Joomla! Component VMap 1.9.6 - SQL Injection Exploit Title: Joomla! Component VMap 1.9.6 - SQL Injection Dork: N/A Date: 2019-01-23 Exploit Author: Ihsan Sencan Vendor Homepage: http://wdmtech.com/ Software Link:...

Joomla VMap 1.9.6 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component VMap 1.9.6 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://wdmtech.com/ Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/vmap/ Version: 1.9....

CVE-2019-6294

An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI...

CVE-2019-6294

An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI...

PT-2019-18081

Name of the Vulnerable Software and Affected Versions EasyCMS version 1.5 Description An issue was discovered that allows for CSRF via the "index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent" URI. Recommendations For EasyCMS version 1.5, consider implementing proper...

CVE-2019-6294: Cross-Site Request Forgery (CSRF)

An issue was discovered in EasyCMS 1.5. There is CSRF via the index.php?s=/admin/articlem/insert/navTabId/listarticle/callbackType/closeCurrent URI...

i-doit CMDB 1.12 - Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: i-doit CMDB 1.12 - Arbitrary File Download Exploit Author: Ihsan Sencan Vendor Homepage: https://www.i-doit.org/ Software Link: https://netcologne.dl.sourceforge.net/project/i-doit/i-doit/1.12/idoit-open-1.12.zip Version: 1.12...

PT-2019-18054

Name of the Vulnerable Software and Affected Versions HuCart version 5.7.4 Description A CSRF issue allows adding an admin account via the /adminsys/index.php?load=admins&act=edit info&act type=add API endpoint. Recommendations For HuCart version 5.7.4, as a temporary workaround, consider...

PT-2019-17967

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue in XiaoCms allows SQL injection via the "table" parameter in the admin/index.php endpoint, specifically "/admin/index.php?c=database table". This can lead to PHP code execution by using "INTO...

CVE-2019-6127: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename...