779 matches found
CVE-2020-10389
admin/save-settings.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by injecting PHP code into any POST parameter when saving global settings...
CVE-2020-10460
CVE-2020-10460 affects Chadha PHPKB Standard Multi-Language 9. The vulnerability exists in admin/include/operations.php (via admin/email-harvester.php), allowing injection of untrusted input into CSV files through the POST parameter data. This is described consistently across multiple sources (NV...
CVE-2020-10460: Improper Neutralization of Formula Elements in a CSV File
admin/include/operations.php via admin/email-harvester.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject untrusted input inside CSV files via the POST parameter data...
oreninform.ru Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1112669 Security Researcher g0bl1nsec Helped patch 3768 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting oreninform.ru website and...
UBUNTU-CVE-2015-4715
The fetch function in OAuth/Curl.php in Dropbox-PHP, as used in ownCloud Server before 6.0.8, 7.x before 7.0.6, and 8.x before 8.0.4 when an external Dropbox storage has been mounted, allows remote administrators of Dropbox.com to read arbitrary files via an @ at sign character in unspecified POS...
Ecommerce Systempay 1.0 - Production KEY Brute Force
Ecommerce Systempay 1.0 - Production KEY Brute Force Exploit Title: Ecommerce Systempay 1.0 - Production KEY Brute Force Author: live3 Date: 2020-02-05 Vendor Homepage: https://paiement.systempay.fr/doc/fr-FR/ Software Link: https://paiement.systempay.fr/doc/fr-FR/module-de-paiement-gratuit/ Test...
Ecommerce Systempay 1.0 Brute Force
Exploit Title: Ecommerce Systempay 1.0 - Production KEY Brute Force Author: live3 Date: 2020-02-05 Vendor Homepage: https://paiement.systempay.fr/doc/fr-FR/ Software Link: https://paiement.systempay.fr/doc/fr-FR/module-de-paiement-gratuit/ Tested on: MacOs Version: ALL ?php / INFORMATION Exploit...
Ecommerce Systempay 1.0 - Production KEY Brute Force Exploit
Exploit for php platform in category web applications Exploit Title: Ecommerce Systempay 1.0 - Production KEY Brute Force Author: live3 Vendor Homepage: https://paiement.systempay.fr/doc/fr-FR/ Software Link: https://paiement.systempay.fr/doc/fr-FR/module-de-paiement-gratuit/ Tested on: MacOs...
ritv.nl Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1073991 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
teabocafe.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1027470 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
Symfony Form Disclosure
The vulnerability of the Form component in the Symfony software development and web application management platform exists due to insufficient validation of input data. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending a specially crafted HTTP request,...
a.tvn.pl Cross Site Scripting vulnerability
Security Researcher logindenied Helped patch 7927 vulnerabilities Received 8 Coordinated Disclosure badges Received 76 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting a.tvn.pl website and its users. Following coordinated...
CVE-2019-13176
An issue was discovered in the 3CX Phone system web management console 12.5.44178.1002 through 12.5 SP2. The Content.MainForm.wgx component is affected by XXE via a crafted XML document in POST data. There is potential to use this for SSRF reading local files, outbound HTTP, and outbound DNS...
Huawei HG530 Reboot / Restore Authentication Bypass
Huawei HG530 Multiple Unauthenticated reboot and restore Vulnerability =========================== The Huawei HG530 suffers from multiple Unauthenticated reboot and restore vulnerability allows local attackers to reboot the device or to restore to factory Configuration without user interaction...
Huawei HG530 Cross Site Request Forgery
Multiple CSRF reboot and restore Vulnerability =========================== The Huawei HG530 suffers from multiple CSRF vulnerability allows local attackers to reboot the device or to restore to factory Configuration. ================== The vulnerability is located in form POST data parameter in...
Sql injection
AbanteCart 1.2.8 allows SQL Injection via the sourcelanguage parameter to admin/controller/pages/localisation/language.php and core/lib/languagemanager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php...
Carel pCOWeb B1.2.1 - Cross-Site Scripting
Carel pCOWeb B1.2.1 - Cross-Site Scripting Exploit Title: Carel pCOWeb - Stored XSS Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.carel.com/ Version: Carel pCOWeb all versions prior to B1.2.1 Tested on: It is a proprietary devices: http://www.carel.com/product/pcoweb-ca...
AUO Solar Data Recorder 1.3.0 - addr Cross-Site Scripting
AUO Solar Data Recorder 1.3.0 - addr Cross-Site Scripting Exploit Title: AUO Solar Data Recorder - Stored XSS Date: 2019-04-16 Exploit Author: Luca.Chiou Vendor Homepage: https://www.auo.com/zh-TW Version: AUO Solar Data Recorder all versions prior to v1.3.0 Tested on: It is a proprietary devices...
CVE-2019-9976
The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users...
CVE-2019-9976
The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users...