Sql injection

An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php...

Cross site scripting

An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php...

SpinetiX Fusion Digital Signage 3.4.8 File Backup/Delete Path Traversal

Summary At SpinetiX we inspire businesses to unlock the potential of their story. We believe in the power of digital signage as a dynamic new storytelling platform to engage with people. For more than 13 years, we have been constantly innovating to deliver cutting-edge digital signage solutions...

CVE-2020-26042

An issue was discovered in Hoosk CMS v1.8.0. There is a SQL injection vulnerability in install/index.php...

CVE-2020-26042

CVE-2020-26042 affects Hoosk CMS v1.8.0 with a SQL injection vulnerability in install/index.php. Per the connected NVD record, the issue yields partial confidentiality, partial integrity, and partial availability impacts (CVSS v2 base 7.5, HIGH; CVSS v3.1 base 9.8, CRITICAL). Exploitation details...

CVE-2020-26041

An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php...

CVE-2020-12282

iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, accessible via /index.php. This can be combined with reflected XSS...

CVE-2020-12281

iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php...

B-swiss 3 Digital Signage System 3.6.5 Backdoor Remote Code Execution

Summary Intelligent digital signage made easy. To go beyond the possibilities offered, b-swiss allows you to create the communication solution for your specific needs and your graphic charter. You benefit from our experience and know-how in the realization of your digital signage project...

Projectworlds House Rental SQL Injection Vulnerability

Projectworlds House Rental is a system used by the Projectworlds organization for house rental functionality. version 1.0 of Projectworlds House Rental is vulnerable to SQL injection, which can be exploited by remote attackers to make POST requests via a malicious index.php...

CVE-2020-23833

Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary code on the hosting webserver via a malicious index.php POST request...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

Sql injection

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-6637

OpenSIS Community Edition 7.3 is affected by CVE-2020-6637: a SQL injection through the USERNAME parameter in index.php. The Nuclei template confirms SQLi in OpenSIS 7.3 and describes the impact as the ability to execute arbitrary SQL queries, potentially leading to data access or manipulation. T...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-15081 Information exposure in the upload directory in PrestaShop

In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory...

Cross site request forgery (csrf)

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

CVE-2020-13155

CVE-2020-13155 concerns a CSRF vulnerability in the NukeViet 4.4 product, where the request to CSRF via clearsystem.php can inject HTML when the deltype parameter is used in the URI admin/index.php?nv=webtools&op=clearsystem. The affected component is the clearsystem functionality in NukeViet 4.4...

College-Management-System-Php 1.0 SQL Injection

Exploit Title: College-Management-System-Php 1.0 - Authentication Bypass / SQL Injection Exploit Author: BLAY ABU SAFIAN Inveteck Global Website: https://github.com/olotieno/College-Management-System-Php Date: 2020-06-16 Google Dork: N/A Vendor: https://github.com/olotieno/ Software Link:...

CVE-2020-13384

Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...