CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

CVE-2020-7786

This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js...

CVE-2020-7782

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package...

CVE-2020-7786

CVE-2020-7786 affects all versions of the npm package macfromip. The vulnerability is a command injection at the injection point in macfromip.js (line 66; SNYK also notes lines 66 and 96 as vulnerable). Exploitation can occur via crafted input without authentication and can lead to remote code ex...

CVE-2020-7786

This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js...

CVE-2020-7785 Command Injection

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js...

Command injection in ts-process-promises

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js...

CVE-2020-7794

This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

CVE-2020-7784

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:...

Design/Logic Flaw

This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function installrequestedModule...

Design/Logic Flaw

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:...

CVE-2020-7781

This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:...

CVE-2020-28439

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...

Input validation

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:...

Media Library Assistant < 2.90 - Authenticated Blind SQL Injection

The Media Library Assistant WordPress plugin was affected by an authenticated admin+ blind SQL injection vulnerability when there is at least one Custom Field Rule set in the plugin's options. PoC There need to be at least one Custom Field Rule in the plugin Custom Fields settings...

CVE-2020-15924

There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injection point resides in one of the authentication parameters...

School ERP Pro 1.0 SQL Injection

Exploit Title: School ERP Pro 1.0 - 'esmessagesid' SQL Injection Date: 2020-04-28 Author: Besim ALTINOK Vendor Homepage: http://arox.in Software Link: https://sourceforge.net/projects/school-erp-ultimate/ Version: latest version Tested on: Xampp Credit: İsmail BOZKURT SQL Injection Detail...

Phpgurukul User Registration v2.0 - Multiple Vulnerabilities

Document Title: =============== Phpgurukul User Registration v2.0 - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2216 Release Date: ============= 2020-04-19 Vulnerability Laboratory ID VL-ID:...

Arbitrary Code Execution

Overview pixl-class is a library that allows you to create classes in a more classical sort of way, including support for static class members, proper constructors, inheritance, and mixins. Affected versions of this package are vulnerable to Arbitrary Code Execution. The injection point is locate...

Serv-U FTP Server 15.1.7 Cross Site Scripting Vulnerability

Exploit for windows platform in category web applications Exploit Title: Serv-U FTP Server 15.1.7 Cross Site Scripting Vulnerability Exploit Author: Cyb0r9 Vendor Homepage: https://www.serv-u.com/ Software Link: https://www.serv-u.com/downloads Version: SOLARWIND Serv-U FTP Server v15.1.7 Tested...