954 matches found
FontForge uiutil.c file injection vulnerability
FontForge is an open source font editing tool that supports multiple languages. A security vulnerability exists in the uiutil.c file in FontForge 20170731 and earlier versions, which stems from the program failing to validate strings before starting the program. A remote attacker can exploit the...
Reddit Terminal Viewer (RTV) Parameter Injection Vulnerability
Reddit Terminal Viewer RTV is a simple terminal viewer for Reddit. A parameter injection vulnerability exists in Reddit Terminal Viewer RTV 1.19.0. The vulnerability arises because scripts/inspectwebbrowser.py in RTV does not validate strings before launching a program specified by the BROWSER...
CVE-2017-17511
KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c...
Sql injection
FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php florig or fldest parameter...
sensible-utils sensible-browser injection vulnerability
sensible-utils is a toolkit for analyzing and launching appropriate browsers, editors and pagers. sensible-browser is one of the browser selection tools. A security vulnerability exists in sensible-browser in versions of sensible-utils prior to 0.0.11, which stems from an undetected string before...
LilyPond lilypond-invoke-editor injection vulnerability
LilyPond is a set of open source audio editing software. lilypond-invoke-editor is one of the tools used to invoke the editor. A security vulnerability exists in lilypond-invoke-editor in LilyPond version 2.19.80, which stems from a failure to detect strings before starting the program. A remote...
Vastal I-Tech Agent Zone - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Vastal I-Tech Agent Zone - SQL Injection Dork: N/A Date: 30.10.2017 Vendor Homepage: http://vastal.com/ Software http://vastal.com/agent-zone-real-estate-script.html Demo: http://agentzone.vastal.com/demo/ Version: N/A Category:...
AROX School ERP PHP Script - 'id' SQL Injection
Exploit Title: AROX School ERP PHP Script - SQL Injection Dork: N/A Date: 30.10.2017 Vendor Homepage: http://arox.in/ Software Link: https://www.codester.com/items/4908/arox-school-erp-php-script Demo: http://erp1.arox.in/ Version: CVE-2017-15978 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...
Basic B2B Script - SQL Injection
Exploit Title: Basic B2B Script - SQL Injection Dork: N/A Date: 30.10.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software Link: http://www.exclusivescript.com/product/nC3F4570353/php-scripts/basic-b2b-script Demo: http://readymadeb2bscript.com/product/entrepreneur/ Version: N/A Category...
Job Board Script - 'nice_theme' SQL Injection
Exploit Title: Job Board Script - SQL Injection Dork: N/A Date: 30.10.2017 Vendor Homepage: http://www.nicephpscripts.com/ Software http://www.nicephpscripts.com/jobboardscript.htm Demo: http://www.nicephpscripts.com/scripts/faqscript/ Version: N/A Category: Webapps Tested on: WiN7x64/KaLiLinuXx6...
CVE-2017-8896
ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters...
MediaWiki Multiple Vulnerabilities (Apr 2017) - Linux
MediaWiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mediawiki:mediawiki"; if...
CVE-2017-9419
Cross-site scripting XSS vulnerability in the Webhammer WP Custom Fields Search plugin 0.3.28 for WordPress allows remote attackers to inject arbitrary JavaScript via the cs-all-0 parameter...
Schneider Electric U.motion Builder syslog_getdata Remote Code Execution Vulnerability
U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in Schneider Electric U.motion Builder sysloggetdata. The base SQLite database query requires SQL injection on the type, level, ishandled, and lastlogid input parameters. A remote...
Schneider Electric U.motion Builder loadtemplate remote code execution vulnerability
U.motion Builder is a builder product from Schneider Electric France. A remote code execution vulnerability exists in the Schneider Electric U.motion Builder loadtemplate. The underlying SQLite database query requires SQL injection on the tpl input parameter. A remote attacker could exploit this...
apache-cxf: XSS in Apache CXF FormattedServiceListWriter
A vulnerability was found in FormattedServiceListWriter in Apache CXF HTTP transport module that could allow an attacker to inject unexpected matrix parameters into the request URL. On a successful injection these matrix parameters will find their way back to the client in the services list page...
Security update for munin (important)
This update for munin fixes the following issues: - An attacker has been able to write arbitrary local files with the permissions of the web server, by using parameter injection boo1026539, CVE-2017-6188 - The MySQL plugin has been fixed to work correctly against MySQL 5.5 on Leap 42.1...
UF FE office platform /assetsGroupReport/vendorContacts. jsp parameters startDate injection vulnerability
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.api.request import req from pocsuite.api.poc import register from pocsuite.api.poc import Output, POCBase import re import requests class TestPOCPOCBase: vulID = '' ssvid version = '1.0' author = '烽火戏诸侯' vulDate =...