PT-2017-9225

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9 Description The issue allows remote attackers to execute arbitrary commands. This is achieved by injecting shell metacharacters in the sc array parameter of the install/index.php file. Recommendations For Exponent CM...

Joomla! Component JE Directory 1.7 - 'ditemid' SQL Injection

Exploit Title: Joomla! Component JE Directory Ads 1.7 - SQL Injection Google Dork: inurl:index.php?option=comjedirectory Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy:...

EXAMPLO - SQL Injection

EXAMPLO - SQL Injection Exploit Title: Examplo - Online Exam System - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://softpae.sk/ Software Buy: https://codecanyon.net/item/examplo-online-exam-system/16174658 Demo: http://munka.softpae.sk/examplo/ Version: N/A Tested on: Wi...

Examplo Online Exam System SQL Injection

Exploit Title: Examplo - Online Exam System - SQL Injection Google Dork: N/A Date: 09.02.2017 Vendor Homepage: http://softpae.sk/ Software Buy: https://codecanyon.net/item/examplo-online-exam-system/16174658 Demo: http://munka.softpae.sk/examplo/ Version: N/A Tested on: Win7 x64, Kali Linux x64...

CVE-2017-5368

ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF Cross Site Request Forgery which allows a remote attack to make changes to the web application as the current logged in victim. If the victim visits a malicious web page, the attacker can silently and...

CVE-2017-5368: Cross-Site Request Forgery (CSRF)

ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF Cross Site Request Forgery which allows a remote attack to make changes to the web application as the current logged in victim. If the victim visits a malicious web page, the attacker can silently and...

PT-2017-16457

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.29 through 1.30 Description The issue allows a remote attack to make changes to the web application as the current logged-in victim, enabling the creation of a new admin user within the application for remote persistence...

PT-2017-16456

Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.29 through 1.30 Description Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder, an open-source CCTV server web application. This allows a remote attacker to execute malicious...

CVE-2017-5367: Improper Neutralization of Input During Web Page Generation

Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample...

karbenopenair.de XSS vulnerability

Vulnerable URL: http://www.karbenopenair.de/index.php?sub=ticketsprompt/OPENBUGBOUNTY/...

CVE-2016-2242

Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php...

CVE-2016-2242: Improper Control of Generation of Code

Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php...

badiklat.sumutprov.go.id XSS vulnerability

Vulnerable URL: http://badiklat.sumutprov.go.id/index.php?id=berita=25'--...

traintime.uk XSS vulnerability

Vulnerable URL: http://www.traintime.uk/index.php?from=PSN'"--!confirmOPENBUGBOUNTY...

Malware exploit: Solar

SQL injection. localhost/index.php POSTDATA i=1881&p=80&u=8302&h=282&s=AUD...

PT-2017-3057

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.7 Patch 3 Description The issue is related to incorrect code generation management in the Exponent CMS content management system. Exploitation of this issue may allow a remote attacker to execute arbitrary co...

CVE-2017-5347

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php...

CVE-2017-5347

SQL injection vulnerability in inc/mod/newsletter/options.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the recipient parameter to gxadmin/index.php...

CVE-2017-5346

SQL injection vulnerability in inc/lib/Control/Backend/posts.control.php in GeniXCMS 0.0.8 allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter to gxadmin/index.php...

CVE-2016-7791: Improper Input Validation

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?installsample=../../files/exploit', which leads to arbitrary code execution...