Multiple loopholes in the cadre online learning platform of Hangzhou Elite Online Education Technology Co.

Hangzhou Elite Online Education Technology Co., Ltd. is a brand of cadre online learning, and has successfully built large-scale cadre education platforms for leading cadres of many organization ministries and other organs in China, providing solutions for all-round intelligent learning. There is...

Arbitrary Password Reset Vulnerability in EBCMS (Newsfeed Edition)

EBCMS is a modular plug-in website management system based on PHP+Mysql. EBCMS News and Information Version has an arbitrary password reset vulnerability that can be exploited by an attacker to change any user's password...

Arbitrary Password Reset Vulnerability in Ruoyi Management System

Ruoyi management system is a SpringBoot2.0 based on the use of Spring, MyBatis, Shiro rights management system . Ruoyi Management System has an arbitrary password reset vulnerability that can be exploited by an attacker to reset any user's password...

CVE-2018-18377

goform/setReset on Orange AirBox Y858FL01.1604 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials...

CVE-2018-18377

CVE-2018-18377 affects Orange AirBox Y858_FL_01.16_04 devices. The flaw allows an attacker to trigger the goform/setReset endpoint to reset the router to factory settings. This reset enables login with default credentials (admin:admin), as described in the Red Hat entry and NVD description. The a...

Niushop open source system mall arbitrary user password reset vulnerability

Niushop open source mall system is by Shanxi Niu Cool Information Technology Co., Ltd. completely independent design, research and development of a PHP open source e-commerce system . Niushop open source system mall there is an arbitrary user password reset vulnerability , attackers can modify th...

Logical Design Vulnerabilities in Jiangsu Jinzhi Education Unified Identity Authentication System

Jiangsu Jinzhi Education Information Co., Ltd. is a well-known provider of informatization services for colleges and universities in China. There is a logical design vulnerability in the Jiangsu Jinzhi Education Unified Identity Authentication System, which can be exploited by an attacker to rese...

CVE-2018-8916

Unverified password change vulnerability in Change Password in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to reset password without verification...

PT-2018-18714 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2-23739 Description: The issue concerns an unverified password change vulnerability in the Change Password feature. This allows remote authenticated users to reset passwords without proper...

Input validation

A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning PCP could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of a password reset request. An attacker could exploi...

istackr.com XSS vulnerability

Open Bug Bounty ID: OBB-616003 Description| Value ---|--- Affected Website:| istackr.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ManageEngine Desktop Central Password Reset Security Bypass Vulnerability

Zohocorp Manage Engine Desktop Central is a computer and mobile device management solution from Zoho. The solution is used to manage devices such as servers, computers, cell phones and tablets in an organization. A security vulnerability exists in Zohocorp Manage Engine Desktop Central 9 build...

CVE-2018-10081

CMS Made Simple CMSMS through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring...

CVE-2018-7195

CVE-2018-7195 concerns Enhancesoft osTicket before 1.10.2. The issue allows a remote attacker to reset arbitrary passwords (when an associated e‑mail address is known) by exploiting guest access and guessing a 6‑digit number. Public sources in the connected documents consistently describe this as...

织梦前台任意用户密码修改

常见的弱类型问题 类型转换问题 类型转换是无法避免的问题。例如需要将GET或者是POST的参数转换为int类型，或者是两个变量不匹配的时候，PHP会自动地进行变量转换。但是PHP是一个弱类型的语言，导致在进行类型转换的时候会存在很多意想不到的问题。 数学运算 当php进行一些数学计算的时候 因为 md5's878926199a'=0e545993274517709034328855841020就是0的n次方，所以还是等于0 但是要注意： "0e123456abc"=="0e1dddada"//false 这种返回的是为假 语句条件的松散判断 函数的松散判断...

gps-server.net GPS Tracking Software < 3.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: GPS-SERVER.NET SAAS CMS Unfortunately each and every POST request in the CMS is going through function mysqlrealescapestring which will add slashes behind every quote in the payload. So you have to make sure your payload doesn't...

Multiple Dahua Products Password Reset Vulnerability

Dahua IPC-HFW and so on are all China DaHua DaHua company network camera equipment. A security vulnerability exists in several Dahua products. The vulnerability can be exploited by an attacker to reset the administrator password...

Arbitrary Account Password Reset Vulnerability in Netxi Smart Android APP

Netxi Smart Android APP is a water purifier monitoring software. Netxi Smart Android APP has a reset any account password vulnerability, the attacker only need the other party's cell phone number to change their passwords, leak the user's sensitive information or loss of funds...

NPM-V < 2.4.2 Password Leak and Reset Vulnerability - Active Check

NPM-V is prone to password leak and password reset vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Trade Test Grabber App Has Arbitrary User Registration and Arbitrary Password Reset Vulnerabilities

Trade Test Grab App is a third-party service platform integrating trade, testing and inspection. Trade test to grab a single App there are any user registration and any password reset vulnerability, the attacker can register any user and reset any user password by grabbing packets and modifying t...