40 matches found
PT-2024-9989 · WordPress · Vibebp
Name of the Vulnerable Software and Affected Versions: VibeBP versions 1.9.9.4.1 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation. This vulnerability is associated with the vibebp register user function in the...
CVE-2024-2409
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the registeruser function called by the 'wpajaxnoprivstmlmsregister' AJAX action. This makes it possible for...
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
Description The plugin does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts. 1. Visit the Profiles Settings page for the plugin: MS LMS LMS Settings Profiles 2. Ensure that "Disable Instructor...
CVE-2023-1690
A vulnerability, which was classified as problematic, has been found in SourceCodester Earnings and Expense Tracker App 1.0. This issue affects some unknown processing of the file LoginRegistration.php?a=registeruser. The manipulation of the argument fullname leads to cross site scripting. The...
PT-2023-17170 · Sourcecodester · Sourcecodester Simple Task Allocation System
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Task Allocation System version 1.0 Description: A problematic issue has been discovered, allowing for cross-site scripting through the manipulation of the Fullname argument in the "LoginRegistration.php?a=register user"...
CVE-2021-24239: Improper Neutralization of Input During Web Page Generation
The Pie Register – User Registration Forms. Invitation based registrations, Custom Login, Payments WordPress plugin before 3.7.0.1 does not sanitise the invitaioncode GET parameter when outputting it in the Activation Code page, leading to a reflected Cross-Site Scripting issue...
Dating Bar App Has Logic Flaws
Dating App is a dating platform. There is a logic vulnerability in Dating Bar APP. An attacker can register any user and reset any password by grabbing packets and blasting through the forget password function...
SQL Injection Via Mailbox
genix/cms is susceptible to SQL injection attacks. The vulnerability is possible because it allows attackers to register a new user by using with a chosen ID using a request such as register.php?act=edit=1...
WordPress Plugin Ultimate Product Catalogue 4.2.2 - SQL Injection
WordPress Plugin Ultimate Product Catalogue 4.2.2 - SQL Injection Exploit Title: Ultimate Product Catalogue 4.2.2 Sql Injection – Plugin WordPress – Sql Injection Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/ultimate-product-catalogue/ Software Link:...
WordPress Plugin WP Private Messages 1.0.1 - SQL Injection (1)
WordPress Plugin WP Private Messages 1.0.1 - SQL Injection 1 Exploit Title: WP Private Messages 1.0.1 – Plugin WordPress – Sql Injection Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/wp-private-messages/ Software Link: https://wordpress.org/plugins/wp-private-messages...
N'CMS 1.1E Pre-Auth Local File Inclusion Code Execution
!/usr/bin/python INFORMATION Exploit Title: NCMS 1.1E Pre-Auth Local File Inclusion Remote Code Exploit Date: 11/3/2011 Software link: http://bit.ly/eJAyw5 Tested on: Linux bt Version: 1.1E PHP.ini Settings: gpcmagicquotes = Off Note: The web application was lucky to not be exploited by session...
Design/Logic Flaw
The registeruser function in client/newaccountform.php in Domain Technologie Control DTC before 0.32.9 includes a cleartext password in an e-mail message, which makes it easier for remote attackers to obtain sensitive information by sniffing the network...
Taobao Dr mutual brush platform Alliance upload vulnerability-vulnerability warning-the black bar safety net
In fact, this vulnerability is a dynamic Shopping Mall that upload issue. if session“useridname””" or session“AdminName””" then this is uploadflash. the asp file to access the authentication, you'll need to register a user can upload. With a bright kid direct upload. Find a keyword, but you can...
Freelancers Marketplace Script Cross Site Scripting
Name : Freelancers Marketplace Script Persistent XSS Vulnerability Date : july 17,2010 Critical Level : HIGH vendor URL :http://www.guruscript.com/ google dork:Powered by Guruscript.com Author : Sid3^effects aKa HaRi special thanks to : r0073r inj3ct0r.com,L0rd...
PHPAuctionSystem PHP Code Execution
====================================================== PHPAuctionSystem Upload Vulnerability ====================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' ...
Discuz! Plugin Crazy Star <= 2.0 (fmid) SQL Injection Vulnerability
Exploit for unknown platform in category web applications =================================================================== Discuz! Plugin Crazy Star = 2.0 fmid SQL Injection Vulnerability ===================================================================...
Discuz! Plugin Crazy Star 2.0 - fmid SQL Injection
Discuz! Plugin Crazy Star 2.0 - fmid SQL Injection ============================================================ Discuz! Plugin Crazy Star = 2.0 Sql injection Vulnerability ============================================================ ========================Author============================ +...
(GET var 'member') BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS <= v1.9 -->
!/usr/bin/perl -------------------------------------------------------------------------------- GET var 'member' BLIND SQL INJECTION EXPLOIT --FAMILY CONNECTIONS = v1.9 -- -------------------------------------------------------------------------------- CMS INFORMATION: --WEB:...
MiniTwitter 0.2b - Multiple SQL Injections
MiniTwitter 0.2b - Multiple SQL Injections || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ¡VIVA SPAIN!...¡GANAREMOS EL MUNDIAL!...o.O ¡PROUD TO BE SPANISH!...
Aztek Forum 4.0 Multiple Vulnerabilities Exploit
No description provided by source. !/usr/bin/php ?php errorreportingEALL ^ ENOTICE; / header Aztek Forum 4.1 Multiple Vulnerabilities Exploit header ================================================== sploit Owner - root status Trying to register a new user sploit Login/Password - phpsploit8435...