481 matches found
CVE-2020-3926
An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter...
Auth0 < 3.11.3 - Unauthenticated Reflected XSS via wle Parameter
XSS via a wle parameter associated with wp-login.php. WP/wp-login.php?wle=%22%20onEvent%3DX186697040Y2Z%20...
ZZZphp sa***.php page la*** parameter has SQL injection vulnerability
zzcms is a PHP and MYSQL based on free open source building system. ZZZphp sa.php page la parameters exist SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information database...
DEBIAN-CVE-2012-1115
A Cross-Site Scripting XSS vulnerability exists in LDAP Account Manager LAM Pro 3.6 in the export, addvalueform, and dn parameters to cmd.php...
Optergy Proton/Enterprise BMS 2.3.0a Open Redirect
Open Redirect in Optergy Proton/Enterprise BMS Firmware version: =2.3.0a CVE: CVE-2019-7275 Advisory: https://applied-risk.com/resources/ar-2019-008 Paper: https://applied-risk.com/resources/i-own-your-building-management-system by Gjoko 'LiquidWorm' Krstic GET /updating.jsp?url=https://segfault....
Sql injection
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...
CVE-2019-16996
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/productadmin.class.php via the admin/?n=product&c=productadmin&a=dopara&apptype=shop id parameter...
CVE-2016-10993
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter...
SQL Injection Vulnerability in ESPCMS Parameter ve**_ke**
ESPCMS is a content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in the ESPCMS parameter veke, which can be exploited by an attacker to obtain sensitive information from the database...
Rest Cafe And Restaurant Website CMS SQL Injection
Exploit Title: Rest - Cafe and Restaurant Website CMS - SQL Injection Date: 1.8.2019. Exploit Author: n1x MS-WEB Vendor Homepage: https://codecanyon.net/item/rest-cafe-and-restaurant-website-cms/21630154 CWE : CWE-89 Vulnerable parameter: slug news.php GET Request GET //host/path/news.php?slug=x'...
CVE-2019-1010191
marginalia 1.6 is affected by: SQL Injection. The impact is: The impact is a injection of any SQL queries when a user controller argument is added as a component. The component is: Affects users that add a component that is user controller, for instance a parameter or a header. The attack vector...
SUSE-SU-2019:14097-1 Security update for libvirt
This update for libvirt fixes the following issues: Security issues fixed: - CVE-2019-10161: Fixed virDomainSaveImageGetXMLDesc API which could accept a path parameter pointing anywhere on the system and potentially leading to execution of a malicious file with root privileges by libvirtd...
Sql injection
An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST paramet...
Code injection
An issue was discovered in Eventum 3.5.0. /htdocs/postnote.php has XSS via the garlicprefix parameter...
XooDigital - 'p' SQL Injection
Exploit Title: XooDigital - 'p' SQL Injection Date: 26.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://xooscripts.com/product/digital-download-protection-script.html Demo Site: http://xooscripts.com/demos/xoodigital/ Version: Lastest Tested on: Kali Linux CVE: N/A ----- PoC :...
Cross site scripting
Stored XSS exists in YzmCMS 5.2 via the admin/systemmanage/userconfigedit.html "value" parameter,...
Cross site scripting
imcat 4.5 has Stored XSS via the root/run/adm.php fminstopnote parameter...
CVE-2018-19906
Stored XSS exists in razorCMS 3.4.8 via the //page description parameter...