ASUSTOR ADM OS Command Injection Vulnerability (CNVD-2018-26932)

ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. An operating system command injection vulnerability exists in the user.cgi file in ASUSTOR ADM version 3.1.1, which can be exploited to execute system commands with root privileges using the 'secretkey' URL...

CVE-2018-12308

Encryption key disclosure in share.cgi in ASUSTOR ADM version 3.1.1 allows attackers to obtain the encryption key via the "encryptkey" URL parameter...

SEMCMS Cross-Site Scripting Vulnerability (CNVD-2019-01725)

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS3.4 version of a cross-site scripting vulnerability, remote attackers can admin/SEMCMSCategories.php?pid=1&lgid=1 URI's 'categorykey ' parameter to take advantage of the vulnerability to inject...

CVE-2018-13818

Twig before 2.4.4 allows Server-Side Template Injection SSTI via the search searchkey parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it...

CVE-2018-13818

Twig before 2.4.4 allows Server-Side Template Injection SSTI via the search searchkey parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it...

PT-2018-12201 · Symfony · Twig

Name of the Vulnerable Software and Affected Versions: Twig versions prior to 2.4.4 Description: The issue allows Server-Side Template Injection SSTI via the search key parameter. It is noted that Twig itself is not a web application, and the responsibility of properly wrapping input to it lies...

Impinj Speedway Connect R420 RFID Reader Cross-Site Scripting Vulnerability

Impinj Speedway Connect R420 RFID Reader is an identifier used to identify and track objects from Impinj USA. A cross-site scripting vulnerability exists in the 'license key' parameter of the web application in Impinj Speedway Connect R420 RFID Reader versions prior to 2.2.2. A remote attacker...

CVE-2018-5303: Improper Neutralization of Input During Web Page Generation

An issue was discovered on the Impinj Speedway Connect R420 RFID Reader before 2.2.2. The license key parameter of the web application is vulnerable to Cross Site Scripting; this vulnerability allows an attacker to send malicious code to another user...

Atlassian Confluence Server Cross-Site Scripting Vulnerability (CNVD-2018-03443)

Atlassian Confluence Server is a suite of professional enterprise knowledge management and collaboration software from Atlassian Australia, which can also be used to build an enterprise WiKi. the software enables collaboration and knowledge sharing amongst team members. A cross-site scripting...

CVE-2017-18085: Improper Neutralization of Input During Web Page Generation

The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through the key parameter...

SugarCRM 3.5.1 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: sugarCRM 3.5.1 XSS refeclted Date: 16/01/2017 Exploit Author: Guilherme Assmann Vendor Homepage: https://www.sugarcrm.com/ Version: 3.5.1 Tested on: kali linux, windows 7, 8.1, 10, ubuntu - Firefox Download...

SugarCRM 3.5.1 Cross Site Scripting

Exploit Title: sugarCRM 3.5.1 XSS refeclted Date: 16/01/2017 Exploit Author: Guilherme Assmann Vendor Homepage: https://www.sugarcrm.com/ Version: 3.5.1 Tested on: kali linux, windows 7, 8.1, 10, ubuntu - Firefox Download...

Trustwave Secure Web Gateway Elevation of Privilege Vulnerability

Trustwave Secure Web Gateway SWG is a web security gateway product from Trustwave, Inc. A security vulnerability exists in Trustwave SWG version 11.8.0.27 and earlier. A remote attacker can exploit the vulnerability by sending the 'publicKey' parameter to the /sendKey URI to add an arbitrary publ...

CVE-2017-17598

Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter...

CVE-2017-17598

Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter...

CVE-2017-17598: Improper Neutralization of Special Elements used in an SQL Command

Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter...

Exponent CMS 2.4.1 SQL Injection Vulnerability

Exponent CMS versions 2.4.1 and below suffer from a remote SQL injection vulnerability. CVE-2017-7991-SQL injection-Exponent CMS Suggested description Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of...

MODX Revolution 'setup/controllers/welcome.php' file remote code execution vulnerability

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the setup/controllers/welcome.php file in MODX Revolution 2.5.4-pl an...

CVE-2016-6266

cccaajaxhandler.php in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the 1 host or 2 apikey parameter in a register action, 3 enable parameter ...

Reflective Cross-Site Scripting Vulnerability in Knight Talent System 'key' Parameter

Knight Talent System is a professional talent system based on PHP + MYSQL as the core development, free + open source. A reflective cross-site scripting vulnerability exists in the search 'key' parameter of the Knight Talent System v4.0 job search function. The vulnerability allows attackers to...