WordPress Emag Marketplace Connector Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL servers to set up a personal blog site.Emag Marketplace Connector plugin is used in which a can be WooCommerec store and the The eMAG Marketplace...

CVE-2017-17043: Improper Neutralization of Input During Web Page Generation

The Emag Marketplace Connector plugin 1.0.0 for WordPress has reflected XSS because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly...

PT-2017-14679

Name of the Vulnerable Software and Affected Versions Emag Marketplace Connector plugin version 1.0.0 Description The issue is related to reflected XSS. The parameter post to the API endpoint "/wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php" is not filtered...

Design/Logic Flaw

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to...

CVE-2017-13699

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to...

CVE-2017-13699

CVE-2017-13699 affects MOXA EDS-G512E (5.1 build 16072215). The password encryption is retrievable from the firmware; the encryption is based on a cleartext chall value sent via POST. An attacker could reverse the password encryption algorithm to obtain it, exposing credentials. No exploitation d...

CVE-2017-13699: Inadequate Encryption Strength

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The password encryption method can be retrieved from the firmware. This encryption method is based on a chall value that is sent in cleartext as a POST parameter. An attacker could reverse the password encryption algorithm to...

PT-2017-13027

Name of the Vulnerable Software and Affected Versions MOXA EDS-G512E version 5.1 build 16072215 Description An issue was discovered where the password encryption method can be retrieved from the firmware. The encryption method is based on a chall value sent in cleartext as a POST parameter. This...

WordPress In Link 1.0 SQL Injection Vulnerability

WordPress In Link plugin version 1.0 suffers from a remote SQL injection vulnerability. Vulnerability Type: SQL injection is POST parameter "keyword" Affected plugin: --------------------------------------- In Link Version: 1.0 Requires WordPress Version: 2.8 or higher Compatible up to: 2.8 URL:...

InLinks 1.0 - Authenticated SQL Injection

SQL injection is POST parameter "keyword" Affected file inlinks/inlinks.php Affected lines: 58 $Keyword = trim$POST'keyword'; 59 $URL = trim$POST'url'; 60 $Rel = trim$POST'rel'; 61 $Target = trim$POST'target'; 62 $tablename = $wpdb-prefix ."URLKeywordsMapping"; 63 $SelectKeywordURLMappingDetails ...

WordPress In Link 1.0 SQL Injection

Vulnerability Type: SQL injection is POST parameter "keyword" Affected plugin: --------------------------------------- In Link Version: 1.0 Requires WordPress Version: 2.8 or higher Compatible up to: 2.8 URL: https://wordpress.org/plugins/inlinks/ plugin has been closed after the report...

WordPress Plugin Polls 1.2.4 - SQL Injection (PoC)

Exploit Title :WordPress Polls plugin1.2.4 SQL Injection vulnerability Vulnerable version:Download Link : https://downloads.wordpress.org/plugin/polls-widget.1.2.4.zip //////////////////////// /// Overview: //////////////////////// WordPress Polls plugin is a tool for creating polls and survey...

Joomla! Component JoomRecipe 1.0.4 - search_author SQL Injection

Joomla! Component JoomRecipe 1.0.4 - searchauthor SQL Injection Exploit Title: Joomla JoomRecipe 1.0.4 Component - Blind SQL Injection Vulnerability Date: 20.07.2017 Exploit Author: Teng Vendor Homepage: http://joomboost.com/ Software Link:...

Schneider Electric Pelco Sarix/Spectra Cameras Root Remote Code Execution Vulnerability

Pelco IP cameras suffer from a code execution vulnerability. The affected cameras suffer from authenticated remote code execution vulnerability. The POST parameter 'enableleds' located in the update function called via the GeneralSetupController.php script is not properly sanitised before being...

Pelco SarixSpectra Cameras - Remote Code Execution

Pelco SarixSpectra Cameras - Remote Code Execution Schneider Electric Pelco Sarix/Spectra Cameras Root Remote Code Execution Vendor: Schneider Electric SE Product web page: https://www.pelco.com Affected version: Sarix Enhanced - Model: IME219 Firmware: 2.1.2.0.8280-A0.0 Sarix Enhanced - Model:...

Code execution vulnerability in ThinkerCMS InputController.class.php

ThinkerPHP is based on thinkphp3.2 development of a rapid development system, which has excellent user experience, efficient development efficiency, simple and easy to get started, etc. ThinkerCMS is ThinkerPHP's content management system dedicated to small websites. A code execution vulnerabilit...

CVE-2017-3129

A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature...

CVE-2017-3129

A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature...

CVE-2017-3129: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions 5.7.1 and below allows attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature...

PT-2017-15676

Name of the Vulnerable Software and Affected Versions Fortinet FortiWeb versions 5.7.1 and below Description A Cross-Site Scripting issue allows an attacker to execute unauthorized code or commands via an improperly sanitized POST parameter in the FortiWeb Site Publisher feature. Recommendations...