CVE-2017-5368

ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF Cross Site Request Forgery which allows a remote attack to make changes to the web application as the current logged in victim. If the victim visits a malicious web page, the attacker can silently and...

CVE-2017-5368: Cross-Site Request Forgery (CSRF)

ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF Cross Site Request Forgery which allows a remote attack to make changes to the web application as the current logged in victim. If the victim visits a malicious web page, the attacker can silently and...

CVE-2017-5367: Improper Neutralization of Input During Web Page Generation

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample...

PT-2017-16456

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.29 through 1.30 Description Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder, an open-source CCTV server web application. This allows a remote attacker to execute malicious...

PT-2017-16457

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.29 through 1.30 Description The issue allows a remote attack to make changes to the web application as the current logged-in victim, enabling the creation of a new admin user within the application for remote persistence...

karbenopenair.de XSS vulnerability

Vulnerable URL: http://www.karbenopenair.de/index.php?sub=ticketsprompt/OPENBUGBOUNTY/...

CVE-2016-2242

Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php...

CVE-2016-2242: Improper Control of Generation of Code

Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php...

badiklat.sumutprov.go.id XSS vulnerability

Vulnerable URL: http://badiklat.sumutprov.go.id/index.php?id=berita=25'--...

traintime.uk XSS vulnerability

Vulnerable URL: http://www.traintime.uk/index.php?from=PSN'"--!confirmOPENBUGBOUNTY...

Malware exploit: Solar

SQL injection. localhost/index.php POSTDATA i=1881&p=80&u=8302&h=282&s=AUD...

PT-2017-3057

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.7 Patch 3 Description The issue is related to incorrect code generation management in the Exponent CMS content management system. Exploitation of this issue may allow a remote attacker to execute arbitrary co...

CVE-2017-5347

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php...

CVE-2017-5347

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php...

CVE-2017-5346

SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php...

PT-2017-16448

Name of the Vulnerable Software and Affected Versions GeniXCMS version 0.0.8 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the recipient parameter to the "gxadmin/index.php" endpoint. Recommendations For GeniXCMS version...

CVE-2017-5346: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php...

CVE-2017-5347: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php...

PT-2017-16447

Name of the Vulnerable Software and Affected Versions GeniXCMS version 0.0.8 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the id parameter to the "gxadmin/index.php" endpoint. Recommendations For GeniXCMS version 0.0.8,...

PT-2017-9346

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9 Description The issue allows for remote code execution. An attacker can upload a malicious file, exploit.tar.gz, to the website and then extract it by visiting the "/install/index.php" endpoint with a specific query...