PT-2017-7556

Name of the Vulnerable Software and Affected Versions Photocrati NextGEN Gallery plugin version 2.1.10 Description The issue concerns unrestricted file upload in the Photocrati NextGEN Gallery plugin for WordPress. This is achieved by modifying the file extension, for example, from .jpg to .php,...

WordPress Participants Database < 1.7.5.10 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Participants Database 1.7.5.10 - XSS Google Dork: inurl:wp-content/plugins/participants-database/ Date: 01-Sep-17 Exploit Author: Benjamin Lim Vendor Homepage: https://xnau.com/ Software Link:...

WordPress Plugin Participants Database < 1.7.5.10 - Cross-Site Scripting

Exploit Title: Wordpress Plugin Participants Database 1.7.5.10 - XSS Google Dork: inurl:wp-content/plugins/participants-database/ Date: 01-Sep-17 Exploit Author: Benjamin Lim Vendor Homepage: https://xnau.com/ Software Link: https://wordpress.org/plugins/participants-database/ Version: 1.7.5.9...

CVE-2017-13778

Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...

Synology DNS Server Directory Traversal Vulnerability

Synology DNS Server is a DNS server solution from Synology. A directory traversal vulnerability exists in SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server versions prior to 2.2.1-3042. A remote attacker can exploit the vulnerability to write arbitrary files with the help of the...

CVE-2017-12074

Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to write arbitrary files via the domainname parameter...

Hewlett Packard Enterprise Intelligent Management Center sshConfig Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

Hewlett Packard Enterprise Intelligent Management Center iccSelectDymicParam Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2017-11469

get2post.php in IDERA Uptime Monitor 7.8 has directory traversal in the filename parameter...

PT-2017-12035

Name of the Vulnerable Software and Affected Versions IDERA Uptime Monitor version 7.8 Description The issue concerns directory traversal in the file name parameter of the "get2post.php" file. Recommendations For IDERA Uptime Monitor version 7.8, consider restricting access to the get2post.php fi...

dotCMS Arbitrary File Upload Vulnerability Vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . An arbitrary file upload vulnerability exists in the com/dotmarketing/servlets/AjaxFileUploadServlet.class file in...

Grab: Blind stored xss [parcel.grab.com] > name parameter

Hi, my previously reported blind xss is fixed but i found same type of xss in diffrent area with more impact. Steps to repro: 1. create new account with name " here https://parcel.grab.com/ 2. afftected page is https://app.detrack.com/a/ where admin can see all the user's of application and this ...

CVE-2017-11416

Fiyo CMS 2.0.7 has SQL injection in /apps/appcomment/controller/insert.php via the name parameter...

CVE-2017-11416

Fiyo CMS 2.0.7 has SQL injection in /apps/appcomment/controller/insert.php via the name parameter...

CVE-2017-11416: Improper Neutralization of Special Elements used in an SQL Command

Fiyo CMS 2.0.7 has SQL injection in /apps/appcomment/controller/insert.php via the name parameter...

PT-2017-11998

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns SQL injection. It can be exploited via the name parameter in the /apps/app comment/controller/insert.php API endpoint. Recommendations For Fiyo CMS version 2.0.7, avoid using the name...

CVE-2017-11354

Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/apparticle/sysarticle.php via the name parameter in editing or adding a tag name...

Sql injection

Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/apparticle/sysarticle.php via the name parameter in editing or adding a tag name...

CVE-2017-11354

Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/apparticle/sysarticle.php via the name parameter in editing or adding a tag name...

CVE-2017-11354: Improper Neutralization of Special Elements used in an SQL Command

Fiyo CMS v2.0.7 has an SQL injection vulnerability in dapur/apps/apparticle/sysarticle.php via the name parameter in editing or adding a tag name...