PT-2017-14882

Name of the Vulnerable Software and Affected Versions FS Indiamart Clone version 1.0 Description The issue concerns SQL Injection, which can be exploited through specific parameters in various PHP files. The vulnerable parameters include the token parameter in 'catcompany.php', the id parameter i...

androidrevolution.nl XSS vulnerability

Open Bug Bounty ID: OBB-448032 Description| Value ---|--- Affected Website:| androidrevolution.nl Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

webapps.fitzmuseum.cam.ac.uk XSS vulnerability

Vulnerable URL: http://webapps.fitzmuseum.cam.ac.uk/explorer/index.php/"'--!confirm/OPENBUGBOUNTY/...

CVE-2017-16920: Undefined Security Weakness

v5/config/system.php in dayrui FineCms 5.2.0 has a default SYSKEY value and does not require key regeneration for each installation, which allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php...

PT-2017-14636

Name of the Vulnerable Software and Affected Versions FineCms version 5.2.0 Description The issue allows remote attackers to upload arbitrary .php files. This is possible due to a default SYS KEY value in the v5/config/system.php file, which does not require key regeneration for each installation...

Directory traversal

LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php...

WordPress: Arbitrary file deletion in wp-core - guides towards RCE and information disclosure

Vulnerable place 1: wp-admin/post.php $newmeta'thumb' is placed into DB not sanitized directly from user input. case 'editattachment': checkadminreferer'update-post' . $postid; // Don't let these be changed unset$POST'guid'; $POST'posttype' = 'attachment'; // Update the thumbnail filename $newmet...

PT-2017-14630

Name of the Vulnerable Software and Affected Versions LvyeCMS versions prior to 3.1 Description The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved through directory traversal sequences in the dir parameter, combined with PHP code in the content...

CVE-2017-16569: URL Redirection to Untrusted Site

An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting...

PT-2017-14453

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.1.57987acc3018 Description A redirect issue exists via an http: URL in the redirectUrl parameter to "app/index.php/meetings/default/createMeeting" endpoint. Recommendations For version 3.2.1.57987acc3018, avoid using the...

CVE-2017-15039: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting...

isara.cvc.ac.th XSS vulnerability

Open Bug Bounty ID: OBB-390772 Description| Value ---|--- Affected Website:| isara.cvc.ac.th Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

EyesOfNetwork web interface 'host' parameter SQL injection vulnerability

EyesOfNetwork EON is an open source, free IT monitoring solution. The solution provides features such as a business process configuration tool, generating pop-up windows when events occur in the active queue, and more. The EyesOfNetwork web interface aka eonweb is one of these web interfaces...

iProject Management System SQL Injection Vulnerability

iProject Management System is a project management software for SMEs. A SQL injection vulnerability exists in iProject Management System version 1.0. The vulnerability can be exploited by remote attackers to inject SQL commands by sending the 'ID' parameter to the index.php file...

CVE-2017-15984

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

Sql injection

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

CVE-2017-15984

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

CVE-2017-15984

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

CVE-2017-15988: Improper Neutralization of Special Elements used in an SQL Command

Nice PHP FAQ Script allows SQL Injection via the index.php nicetheme parameter, a different vulnerability than CVE-2008-6525...

PT-2017-14339

Name of the Vulnerable Software and Affected Versions Creative Management System CMS Lite version 1.4 Description The issue allows SQL Injection via the S parameter to the "index.php" endpoint. Recommendations For Creative Management System CMS Lite version 1.4, consider restricting access to the...