CVE-2019-7545

In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting XSS vulnerability in the User Name field...

The vulnerability of the PeopleSoft Enterprise SCM eProcurement (Manage Requisition Status) component of the Oracle PeopleSoft products allows a perpetrator to gain unauthorized access to protected data.

The vulnerability of the PeopleSoft Enterprise SCM eProcurement Manage Requisition Status component of the Oracle PeopleSoft products is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected data using the...

Unspecified Vulnerability in Oracle PeopleSoft Products (CNVD-2019-29277)

Oracle PeopleSoft Products is a suite of enterprise human capital management solutions from Oracle that provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise SCM eProcurement is one of the online procurement components. PeopleSoft...

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting

MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Date: 12/31/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on...

MyT Project Management 1.5.1 SQL Injection

Exploit Title: MyT-PM 1.5.1 - 'Chargegrouptotal' SQL Injection Date: 03.01.2019 Exploit Author: Mehmet Ander Key Vendor Homepage: https://manageyourteam.net/ Software Link: https://sourceforge.net/projects/myt/ Version: v1.5.1 Category: Webapps Tested on: WAMPP @Win Software description: MyT Mana...

No-CMS Cross-Site Scripting Vulnerability

No-CMS is a free content management system. The system supports authentication and authorization, custom themes and module extensions. A cross-site scripting vulnerability exists in No-CMS version 1.1.3. A remote attacker can use the 'keyword' parameter on the blog/managearticle page to inject...

PT-2019-16760 · Zoho Manageengine · Adselfservice Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADSelfService Plus versions 5.x before build 5703 Description: The issue is related to a Server-Side Request Forgery SSRF in Zoho ManageEngine ADSelfService Plus. Recommendations: For versions 5.x before build 5703, update t...

Cross site scripting

No-CMS 1.1.3 is prone to Persistent XSS via the blog/managearticle/index/ "articletitle" parameter...

Veeam Availability Console U1 Cumulative Patch 1913

Challenge Veeam Availability Console U1 Cumulative Patch 1913. This update supersedes Veeam Availability Console U1 Cumulative Patch 1850. Cause Please confirm you are running version 2.0.2.1750 or later prior to installing this cumulative patch 1913. You can check this under Windows Programs and...

CVE-2018-19547

JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...

CVE-2018-19546

JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...

JTBC(PHP) Cross-Site Scripting Vulnerability

JTBC PHP is an open source CMS Content Management System. A cross-site scripting vulnerability exists in JTBC PHP version 3.0.1.7. A remote attacker can exploit the vulnerability by sending the 'content' parameter to console/xml/manage.php?type=action&action=edit URL to inject arbitrary Web scrip...

No-Cms 1.0 SQL Injection

Exploit Title: No-Cms 1.0 - 'orderby' SQL Injection Date: 2018-11-28 Exploit Author: Loading Kura Kura Vendor Homepage: https://github.com/goFrendiAsgard/No-CMS Software Link: https://codeload.github.com/goFrendiAsgard/No-CMS/zip/master Tested on: Win10/Kali Linux Google Dork: n/a Version: n/a CV...

JTBC (PHP) Cross-Site Request Forgery Vulnerability (CNVD-2018-26794)

JTBC PHP is an open source CMS Content Management System. A cross-site request forgery vulnerability exists in JTBC PHP version 3.0.1.7. A remote attacker can exploit this vulnerability to perform unauthorized operations with the help of console/xml/manage.php?type=action&action=edit URI...

Cross site request forgery (csrf)

An issue was discovered in JTBCPHP 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF...

Cross-Site Scripting (XSS)

DotNetNuke.Core is vulnerable to cross-site scripting. A remote authenticated attacker is able to inject arbitrary Javascript via the Display Name field under Manage Profile...

Veeam Availability Console U1 Cumulative Patch 1850

Challenge Veeam Availability Console U1 Cumulative Patch 1850. This update supersedes Veeam Availability Console U1 Cumulative Patch 1824. Cause Please confirm you are running version 2.0.2.1750 or later prior to installing this cumulative patch 1850. You can check this under Windows Programs and...

CVE-2018-17782

A cross-site scripting XSS vulnerability in the Manage Filters page managefilterpage.php in MantisBT 2.1.0 through 2.17.1 allows remote attackers if access rights permit it to inject arbitrary code if CSP settings permit it through a crafted project name...

CVE-2018-17782

A cross-site scripting XSS vulnerability in the Manage Filters page managefilterpage.php in MantisBT 2.1.0 through 2.17.1 allows remote attackers if access rights permit it to inject arbitrary code if CSP settings permit it through a crafted project name...

CVE-2018-17782

A cross-site scripting XSS vulnerability in the Manage Filters page managefilterpage.php in MantisBT 2.1.0 through 2.17.1 allows remote attackers if access rights permit it to inject arbitrary code if CSP settings permit it through a crafted project name...