CVE-2024-6536

Description This script is a PoC for CVE-2024-6536, where a XSS is possible in the Zephyr Project Manager plugin for Wordpress. It requires authentication and privileges as a project manager administrator. Usage python3 CVE-2024-6536.py -u -p -w Example: python3 CVE-2024-6536.py -u user -p user -...

CVE-2025-7037

SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database...

CVE-2023-28330: Improper Input Validation

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default...

PT-2022-16749

Name of the Vulnerable Software and Affected Versions Luocms version 2.0 Description The issue allows an attacker to obtain sensitive information through SQL injection statements in the "/admin/manager/admin mod.php" API endpoint. Recommendations For Luocms version 2.0, as a temporary workaround,...

CVE-2019-17175

joyplus-cms 1.6.0 allows manager/adminpic.php?rootpath= absolute path traversal...

PT-2019-14982

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for absolute path traversal via the rootpath parameter in the manager/admin pic.php endpoint. Recommendations For joyplus-cms version 1.6.0, consider restricting access to the manager/admi...

PT-2018-12551

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue concerns SQL Injection in the manager/admin ajax.php file. This can be exploited by sending crafted POST data, for example, a substring like "m id=1 AND SLEEP5". Recommendations For joyplus-cms...

PT-2018-12482

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for XSS via the "manager/admin ajax.php" API endpoint, specifically through the can search device array parameter. Recommendations For joyplus-cms version 1.6.0, consider restricting acces...

PT-2018-12483

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue is related to SQL Injection, which can be exploited via the val parameter in the "manager/admin ajax.php" API endpoint. Recommendations For joyplus-cms version 1.6.0, avoid using the val paramete...

PT-2018-9677

Name of the Vulnerable Software and Affected Versions: joyplus-cms version 1.6.0 Description: The issue concerns a Cross-Site Scripting XSS problem. It is exploited through the device name parameter in a "manager/admin ajax.php?action=save flag=add" request, specifically the "/manager/admin...

joyplus-cms cross-site scripting vulnerability (CNVD-2018-08675)

joyplus-cms is an efficient video movie website management system built with PHPmysql. A cross-site scripting vulnerability exists in manager/adminvod.php in joyplus-cms 1.6.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the keyword parameter...

PT-2018-9658

Name of the Vulnerable Software and Affected Versions: joyplus-cms version 1.6.0 Description: The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the keyword parameter of the manager/admin vod.php file...

PT-2018-18622

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue concerns an XSS vulnerability. It can be exploited via the "manager/admin ajax.php?action=save&tab=prevod type" API endpoint, specifically through the t name parameter. Recommendations For...

PT-2018-18621

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for Remote Code Execution due to an Arbitrary File Upload problem. This is related to the "manager/editor/upload.php" and "manager/admin vod.php?action=add" API endpoints, specifically the...

PT-2018-18595

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for CSRF, as demonstrated by adding an administrator account via a "manager/admin ajax.php?action=save&tab=premanager" request. This can be exploited by sending a malicious request to the...

CVE-2017-14802: URL Redirection to Untrusted Site

Novell Access Manager Admin Console and IDP servers before 4.3.3 have a URL that could be used by remote attackers to trigger unvalidated redirects to third party sites...

phpreality-rfi.txt

|-------------------------------------------------------------------------------| | | | phpRealty 0.02 MGR Remote File include | | | | Script : phpRealty | | Version : 0.02 | | Authord : QTRinux | | Contact : Qataro at hotmail dot com | | Vendor : http://phprealty.budissy.com/phprealty/v0.02/ | |...

phpRealty 0.02 (MGR) Multiple Remote File Inclusion Vulnerabilities

No description provided by source. |-------------------------------------------------------------------------------| | | | phpRealty 0.02 MGR Remote File include | | | | Script : phpRealty | | Version : 0.02 | | Authord : QTRinux | | Contact : Qataro at hotmail dot com | | Vendor :...