CVE-2017-17927

PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATHINFO to service-list/category/...

CVE-2017-17928

PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter...

Code injection

PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter...

Design/Logic Flaw

PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/reviewuserwise.php...

CVE-2017-17929

The CVE concerns PHP Scripts Mall Professional Service Script. Affected component: admin/bannerview.php with the view parameter vulnerable to XSS. This is described across multiple sources as a cross-site scripting vulnerability in the Professional Service Script, enabling script execution via th...

CVE-2017-17930

The affected software is PHP Scripts Mall Professional Service Script. It contains a Cross-Site Request Forgery (CSRF) vulnerability exploitable via admin/general_settingupd.php, demonstrated by changing a setting in the user panel. The root cause and specific impact details are described across ...

CVE-2017-17927

CVE-2017-17927 : The vulnerability is in PHP Scripts Mall Professional Service Script, where a remote attacker can obtain sensitive full-path information by sending a crafted PATH_INFO to the URL path service-list/category/. The root cause is improper handling of PATH_INFO in that script, leading...

CVE-2017-17924

The CVE-2017-17924 vulnerability affects PHP Scripts Mall Professional Service Script, enabling information disclosure: remote attackers can obtain sensitive full-path information via the id parameter in admin/review_userwise.php. Root cause is improper handling of the id parameter, leading to ex...

CVE-2017-17925

PHP Scripts Mall Professional Service Script has XSS via the admin/generalsettingupd.php websitetitle parameter...

CVE-2017-17926

CVE-2017-17926 concerns the PHP Scripts Mall Professional Service Script, where a predictable registration URL enables remote attackers to create accounts using invalid or spoofed email addresses. The description across multiple connected documents consistently identifies the vulnerability as a p...

CVE-2017-17928

The CVE-2017-17928 entry concerns PHP Scripts Mall Professional Service Script. It describes an SQL injection vulnerability in the admin/review.php endpoint triggered via the id parameter, allowing an attacker to manipulate queries. Connected CNVD/NVD records corroborate a SQL injection vulnerabi...

PHP Scripts Mall Professional Service Script SQL Injection Vulnerability

PHP Scripts Mall Professional Service Script is a set of PHP based professional service website scripts by PHP Scripts Mall India. The script is able to provide users with the required information about professional service providers. A SQL injection vulnerability exists in PHP Scripts Mall...

New Nessus 7 Professional and the end of cost-effective Vulnerability Management (as we knew it)

It's an epic and really sad news. When people asked me about the cost-effective solution for Vulnerability Management I usually answered: "Nessus Professional with some additional automation through Nessus API". With just a couple of Nessus Professional scanning nodes it was possible to scan all...

CVE-2017-17625

Professional Service Script 1.0 has SQL Injection via the service-list city parameter...

CVE-2017-17625

Professional Service Script 1.0 has SQL Injection via the service-list city parameter...

Sql injection

Professional Service Script 1.0 has SQL Injection via the service-list city parameter...

CVE-2017-17625

CVE-2017-17625 concerns PHP Scripts Mall Professional Service Script 1.0, where the SQL injection vulnerability exists in the service-list endpoint via the city parameter. The root cause is an injectable SQL query exposed by the city input, enabling an attacker to manipulate the database. Public ...

CVE-2017-17625

Professional Service Script 1.0 has SQL Injection via the service-list city parameter...

Professional Service Script 1.0 SQL Injection

Exploit Title: Professional Service Script 1.0 - SQL Injection Dork: N/A Date: 09.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/professional-service-script/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A...

Cimetrics BACnet Explorer 4.0 XXE Vulnerability

Summary The BACnet Explorer is a BACnet client application that helps auto discover BACnet devices. Description BACnetExplorer suffers from an XML External Entity XXE vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected...