HT Mega < 2.3.4 - Arbitrary Plugin/Theme Activation via CSRF

Description The plugin does not have CSRF checks in various functions in its admin/include/template-library.php file, which could allow attackers to make logged in admins activate plugins/themes via CSRF attacks...

webTareas SQL Injection Vulnerability

webTareas is a web-based open source collaboration tool. The product supports features such as project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas 2.4 and earlier versions, where an unauthenticated user can perform time and...

CVE-2021-41920: Improper Neutralization of Special Elements used in an SQL Command

webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sorcible, sorchamps, and sorordre HTTP POST parameters. This allows an attacker to access all the data in the database and obtain...

CVE-2021-38355: Improper Neutralization of Input During Web Page Generation

The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the /bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3...

U.S. Dept Of Defense: [SQLI ]Time Bassed Injection at ██████████ via /██████/library.php?c=G14 parameter

Step-by-step Reproduction Instructions copy the request to your burp suite : GET /█████████/library.php?c=G14'XORifnow=sysdate,sleep11,0OR' HTTP/1.1 Host: ██████ Accept-Encoding: gzip, deflate Accept: / Accept-Language: en User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36...

worldvet.org XSS vulnerability

Open Bug Bounty ID: OBB-659561 Description| Value ---|--- Affected Website:| worldvet.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

theallianceforec.org XSS vulnerability

Vulnerable URL: http://www.theallianceforec.org/library.php?c=2%27%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E=298 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 05.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 7314939 VIP websi...

wrekage.org XSS vulnerability

Vulnerable URL: http://www.wrekage.org/library.php?artists=A%27%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9894128 VIP website status:| No Coordinated Disclosure...

Veryide 2.1 /library.php SQL注入漏洞

No description provided by source...

CVE-2008-2044: Improper Control of Generation of Code

includes/library.php in netOffice Dwins 1.3 p2 compares the demoSession variable to the 'true' string literal instead of the true boolean literal, which allows remote attackers to bypass authentication and execute arbitrary code by setting this variable to 1, as demonstrated by uploading a PHP...