Remote file inclusion

ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do...

CVE-2017-9362

CVE-2017-9362 affects ManageEngine ServiceDesk Plus prior to version 9312, where an XML injection vulnerability exists in the CMDB API’s add Configuration items endpoint. The issue allows crafted XML data to be processed by the application, potentially impacting confidentiality, integrity, and av...

CVE-2017-9362

ManageEngine ServiceDesk Plus before 9312 contains an XML injection at add Configuration items CMDB API...

CVE-2017-9376

ManageEngine ServiceDesk Plus is affected by CVE-2017-9376 via a Local File Inclusion (LFI) in the defModule parameter of DefaultConfigDef.do and AssetDefaultConfigDef.do. Affected software versions are SDP before 9314; the issue arises from insufficient input validation, enabling an attacker to ...

CVE-2017-9376

ManageEngine ServiceDesk Plus before 9314 contains a local file inclusion vulnerability in the defModule parameter in DefaultConfigDef.do and AssetDefaultConfigDef.do...

Matri4Web Matrimony Web Script SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Matrimony Website Script - Multiple SQL Injection Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.matri4web.com Demo Site: https://www.matrimonydemo.com Version: M-Plus Tested on: Kali Linux CVE: N/A ----- PoC 1:...

Matri4Web Matrimony Website Script - Multiple SQL Injection

Exploit Title: Matrimony Website Script - Multiple SQL Injection Date: 22.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.matri4web.com Demo Site: https://www.matrimonydemo.com Version: M-Plus Tested on: Kali Linux CVE: N/A ----- PoC 1: SQLi ----- Request:...

CVE-2019-7161

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data...

CVE-2019-7161

An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the submitticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the subject parameter in...

CVE-2018-15508

Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control allowing a remote attackers to cause a denial of service via opening a connection on port 8083 to a device running the Five9 SoftPhoneissue 1 of 2...

Five9 Agent Desktop Plus Access Control Error Vulnerability

Five9 Agent Desktop Plus is a suite of cloud-based contact center software from Five9 USA. An access control error vulnerability exists in Five9 Agent Desktop Plus version 10.0.70. A remote attacker could exploit the vulnerability to execute code...

ZOHO ManageEngine ADSelfService Plus Information Disclosure Vulnerability

ZOHO ManageEngine ADSelfService Plus is a Web-based end-user password management software from ZOHO. An information disclosure vulnerability exists in Zoho ManageEngine ADSelfService Plus 5.x =build 5704, which stems from the product's use of a fixed encryption key to protect information, and can...

WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability found by Christian Angel in WordPress WP Support Plus Responsive Ticket System plugin versions = 9.1.1. Solution Update the WordPress WP Support Plus Responsive Ticket System plugin to the latest available version at least 9.1.2...

CVE-2019-7299

CVE-2019-7299 concerns a stored XSS in the WP Support Plus Responsive Ticket System WordPress plugin, specifically in submit_ticket.php (path: wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/ajax/submit_ticket.php) for version 9.1.1. The vulnerability allows injection of arbi...

CVE-2018-15509

Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control issue 2 of 2...

CVE-2018-15509

Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control issue 2 of 2...

CVE-2018-15508

Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control allowing a remote attackers to cause a denial of service via opening a connection on port 8083 to a device running the Five9 SoftPhoneissue 1 of 2...

CVE-2018-15508

Summary: CVE-2018-15508 affects Five9 Agent Desktop Plus 10.0.70, where an incorrect access control allows a remote attacker to cause a denial of service by opening a connection on port 8083 to a device running the Five9 SoftPhone. The NVD entry documents the issue with a network-based vector and...

CVE-2019-0662

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface GDI handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0618...