Multi Store Inventory Management System 1.0 Account Takeover Vulnerability

Exploit Title: Multi Store Inventory Management System - Account Takeover Unauthenticated Exploit Author: Saud Alenazi Vendor Homepage: https://www.bdtask.com/ Software Link: https://www.campcodes.com/projects/php/complete-multi-store-inventory-management-system-in-php-mysql/ Version: 1.0 Tested...

Multi Store Inventory Management System 1.0 Account Takeover

Exploit Title: Multi Store Inventory Management System - Account Takeover Unauthenticated Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.bdtask.com/ Software Link: https://www.campcodes.com/projects/php/complete-multi-store-inventory-management-system-in-php-mysql/...

Online Banquet Booking System 1.0 Cross Site Request Forgery

Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery CSRF Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/ Version: 1.0...

CVE-2022-24813

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the master branch of CreateWiki's GitHub repository...

Exploit for Code Injection in Vmware Spring_Framework

Spring4Shell - CVE-2022-22965 Build - let's clone the repo...

SQL Injection in Dolibarr

An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 fixed version is 14.0.0 via a POST request to the countryid parameter in an UPDATE statement...

Sql injection

An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 fixed version is 14.0.0 via a POST request to the countryid parameter in an UPDATE statement...

CVE-2021-36625

An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 fixed version is 14.0.0 via a POST request to the countryid parameter in an UPDATE statement...

Exploit for Code Injection in Vmware Spring_Framework

Spring Framework RCE exploitation Quick pentest notes...

Jenkins JiraTestResultReporter Plugin跨站请求伪造漏洞

Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier versions are vulnerable to cross-site request forgery, which stems from a...

ThirstyAffiliates Affiliate Link Manager < 3.10.5 - Subscriber+ Arbitrary Affiliate Links Creation

The plugin does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website fetch"/wp-admin/admin-ajax.php", "headers":...

Fingerprint Attendance 1.0 Account Takeover Vulnerability

Title: Fingerprint Attendance 1.0 Account Takeover Author: Hejap Zairy Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache Fingerprint...

Fingerprint Attendance 1.0 Account Takeover

Title: Fingerprint Attendance 1.0 Account Takeover Author: Hejap Zairy Date: 29.07.2022 Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache...

CVE-2022-26258

D-Link DIR-820L 1.05B03 was discovered to contain remote command execution RCE vulnerability via HTTP POST to get set ccp...

IBM ISS BlackICE PC 安全漏洞

IBM ISS BlackICE PC is a personal firewall/IDS for Windows desktops from International Business Machines IBM. A security vulnerability exists in IBM ISS BlackICE PC Protection that stems from Cross Site Scripting Detection causing an elevation of privilege when processing operations that are part...

CVE-2022-25523

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...

CVE-2022-25523

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...

Cross site request forgery (csrf)

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...

CVE-2022-25523

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...

CVE-2022-25523

TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery CSRF which is exploited via a crafted POST request...