PT-2017-12167

Name of the Vulnerable Software and Affected Versions ZenCart version 1.5.5e Description The issue arises from the traverseStrictSanitize function in admin dir/includes/classes/AdminRequestSanitizer.php, which mishandles key strings. This allows remote authenticated users to execute arbitrary PHP...

PT-2017-12116

Name of the Vulnerable Software and Affected Versions dayrui FineCms version 5.0.9 Description The issue concerns a Cross Site Scripting XSS problem. It occurs in the admin/Login.php file when a specific payload is entered into the username field, provided the payload does not start with a ''...

CVE-2017-11581: Improper Neutralization of Input During Web Page Generation

dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...

CVE-2017-11581

dayrui FineCms 5.0.9 has Cross Site Scripting XSS in admin/Login.php via a payload in the username field that does not begin with a '' character...

Stellar.org: HTTP - Basic Authentication on https://www.stellar.org/wp-login.php

Greetings, noticed https://www.stellar.org/wp-login.php using basic authentication. PoC: YWRtaW46YWRtaW4= is base64 encode of admin:admin Impact: Vulnerable to client side attacks. Vulnerable to MITM attack. Vulenrable to Eavesdropping attack. Vulnerable to Brute force attacks. Fix: HTTP-Basic...

cvsnwk.org XSS vulnerability

Vulnerable URL: http://www.cvsnwk.org/cvsm/login.php Details: Description| Value ---|--- Patched:| No Latest check for patch:| 29.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4223347 VIP website status:| No Check cvsnwk.org SSL connection:| Grade: F...

my.cashtrain.com.au XSS vulnerability

Vulnerable URL:...

punt.nl XSS vulnerability

Vulnerable URL: http://www.punt.nl/login.php/'-alert'OPENBUGBOUNTY'-' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 134247 VIP website status:| No Check punt.nl SSL connection:|...

CaseAware Cross Site Scripting

Exploit Title: CaseAware Cross Site Scripting Vulnerability Date: 20th May 2017 Exploit Author: justpentest Vendor Homepage: https://caseaware.com/ Version: All the versions Contact: [email protected] CVE : 2017-5631 Source:...

CVE-2016-10329

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

CVE-2016-10329

Affected product: Synology Photo Station (prior to version 6.5.3-3226). Vulnerability: Command injection in login.php that allows remote attackers to execute arbitrary code through shell metacharacters in a crafted X-Forwarded-For header. Impact: Remote code execution with high risk (as noted by ...

CVE-2016-10329: Improper Neutralization of Special Elements used in a Command

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header...

CVE-2017-8295

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...

CVE-2017-8295: Weak Password Recovery Mechanism for Forgotten Password

WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message, which makes it easier for remote attackers to reset arbitrary passwords by making a crafted wp-login.php?action=lostpassword request and then arranging for this message to bounce or be resent, leading to...

Cross site scripting

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter i.e., "usr" that is transmitted in the login.php query string...

CVE-2017-5631

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter i.e., "usr" that is transmitted in the login.php query string...

CVE-2017-5631: Improper Neutralization of Input During Web Page Generation

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter i.e., "usr" that is transmitted in the login.php query string...

PT-2017-16631

Name of the Vulnerable Software and Affected Versions KMCIS CaseAware affected versions not specified Description An issue was discovered in KMCIS CaseAware, where reflected cross-site scripting is present in the usr parameter transmitted in the "login.php" query string. Recommendations At the...

CVE-2016-10322

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

PT-2017-7860

Name of the Vulnerable Software and Affected Versions Synology Photo Station versions prior to 6.3-2958 Description The issue allows remote authenticated guest users to execute arbitrary commands. This can be achieved by using shell metacharacters in the X-Forwarded-For HTTP header to the...