166 matches found
Exploit for CVE-2024-27697
FuguHub 8.4 Authenticated RCE Fuguhub is a Cloud Media Serve...
Jenkins cli Ampersand Replacement Arbitrary File Read
This module utilizes the Jenkins cli protocol to run the help command. The cli is accessible with read-only permissions by default, which are all thats required. Jenkins cli utilizes args4j's parseArgument, which calls expandAtFiles to replace any @ with the contents of a file. We are then able t...
Conference Management Software 3.5.1 SQL Injection
==================================================================================================================================== | Title : Conference Management Software V3.5.1 Sql injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla...
SQL injection in Data Objects function
Description Log in as an admin, go to Data Objects function, and perform a sort action. Observer the request on Burpsuite and injection point is the 'sort' parameter Proof of Concept POC request that makes the application sleep for 5 seconds Data Objects function payload:...
SQL injection in some Admin Sort functions
Description SQL injection due to unsanitized concatenating strings into ORDER BY clause, 'sort' parameter Proof of Concept Log in as an admin, go to Admin Translations or Application Logger functions, and perform a sort action Observer the request on Burpsuite and injection point is the 'sort'...
Human Resources Management System v1.0 - Multiple SQLi
Exploit Title: Human Resources Management System v1.0 - Multiple SQLi Date: 16/03/2023 Exploit Author: Abdulhakim Öner Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.ht...
Online Graduate Tracer System - Multiple SQL injection Vulnerabilities
A Blind SQL injection vulnerability in the fill-in forms of Online Graduate Tracer System allows remote unauthenticated attackers to execute remote arbitrary SQL commands through "age" parameter. Description A Blind SQL injection vulnerability in the fill-in forms of Online Graduate Tracer System...
Shopify: XSS in www.shopify.com/markets?utm_source=
Hello, hope you are having a good day : Summary: I found a reflected XSS in www.shopify.com/markets using the utmsource parameter Reflected XSS vulnerabilities arise when the application accepts a malicious input script from a user and then it is executed in the victim's browser. Since the XSS is...
GHSA-MPWP-PF96-9G4R npos-tesseract Command Injection vulnerability
A command injection vulnerability affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js...
GHSA-3486-RVXC-HRRJ gitblame susceptible to command injection
A command injection vulnerability affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js...
CVE-2020-28453
This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js...
CVE-2020-28453
This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js...
CVE-2020-28434
This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js...
CVE-2020-28437
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js...
Design/Logic Flaw
This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js...
PT-2022-8890 · Gitblame · Gitblame
Name of the Vulnerable Software and Affected Versions: gitblame affected versions not specified Description: A command injection issue affects the package. The injection point is located in line 15 in lib/gitblame.js. Recommendations: At the moment, there is no information about a newer version...
CVE-2020-28435
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js...
CVE-2020-28438
This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js...