1738 matches found
CVE-2021-38699-Reflected-XSS
CVE-2021-38699：TastyIgniter v3.0.7 餐厅 CMS 中的多处反射型 XSS TastyIgniter 管理后台 3.0.7 版本中存在已认证的反射型 XSS。 https://vulners.com/cve/CVE-2021-38699 POC： 管理后台 dashboard 的 start 参数： root@kitploit: POST http://cvefarm.local/admin/dashboard HTTP/1.1 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101...
CVE-2021-39287-Stored-XSS
CVE-2021-39287-Stored-XSS CVE-2021-39287 TastyIgniter v3.0.7 餐厅 CMS 中的存储型 XSS 漏洞 TastyIgniter v3.0.7 餐厅 CMS 中存在一个存储型跨站脚本 XSS 漏洞。位于 /admin/locations/settings 的描述输入字段未正确过滤，允许将任意代码存储在站点内。 受影响组件 URL: /admin/locations/settings 概念验证 POC 向下滚动到 "Descriptions" 输入任意句子和任意代码： "" 保存页面，将会出现一个弹出框，显示句子 All Your...
CVE-2021-38817-Remote-OS-Command-Injection
CVE-2021-38817-远程操作系统命令注入 TastyIgniter v3.0.7 Sendmail 网页部分中存在经过身份验证的远程操作系统命令注入/远程代码执行漏洞 CVE-2021-38817 TastyIgniter v3.0.7 餐厅CMS的 Sendmail 配置菜单中存在经过身份验证的远程操作系统命令注入漏洞。Sendmail 路径参数未正确清理，如字段中预填的 /usr/sbin/sendmail -bs 命令所示，通过添加分号和额外的操作系统命令可注入任意命令。 受影响组件 URL: /admin/settings/edit/mail 字段: 邮件协议:...
CVE-2021-38699-Stored-XSS
CVE-2021-38699：TastyIgniter v3.0.7 餐厅 CMS 中的存储型 XSS TastyIgniter v3.0.7 餐厅管理系统的 Web 应用系统日志部分存在已认证的存储型跨站脚本漏洞。 https://vulners.com/cve/CVE-2021-38699 POC 1. 在 Web 应用的其他位置执行反射型跨站脚本（参见 https://github.com/HuskyHacks/CVE-2021-38699-Reflected-XSS）。 2. 导航到系统日志部分 3. XSS 载荷应触发。 4. 刷新页面。 5. XSS 载荷应触发。 发现时间...
primefaces
テーブルからコードへ：レストランPOSにおけるRCE脆弱性の旅 今回、たまたまレストラン向けPOSアプリケーションXETUXに存在する脆弱性に遭遇しました。これはレストランの監視と自動化のためのソリューションです。パナマでは多くのレストランで広く使用されています。 この脆弱性はRCE（リモートコード実行）であり、攻撃者が認証なしでコードを実行し、ターゲット上で特権を取得することを可能にします。 1. 列挙...
CVE-2025-65320
CVE-2025-65320 CVE-2025-65320：Abacre Restaurant Point of Sale POS 中的内存敏感信息明文存储漏洞。 所有版本（最高至 15.0.0.1656）的 Abacre Restaurant Point of Sale POS 均存在内存中敏感信息明文存储漏洞。在激活尝试期间，应用程序会将有效的、绑定设备的许可证密钥保留在进程内存中。攻击者可通过将进程附加到调试器并分析进程/内存转储来获取这些密钥，然后无需购买即可在同一台机器上激活软件。 下面，我们提供了动态分析和调试器输出的证据，表明这些密钥在激活尝试期间被分配并保留在进程内存中。...
CVE-2024-38793-PoC
CVE-2024-38793-PoC Proof of Concept code for exploitation of CVE-2024-38793 Best Restaurant Menu by PriceListo = 1.4.1 - Authenticated Contributor+ SQL Injection. Proof Of Concept This is a proof of concept exploit for the vulnerability CVE-2024-38793, an SQL injection vulnerability for versions ...
CVE-2025-65320
CVE-2025-65320 标题 Abacre Restaurant Point of Sale POS 进程内存中以明文形式存储敏感许可材料 概览 在 Abacre Restaurant Point of Sale POS 版本 = 15.0.0.1656 中存在一个漏洞，其中敏感许可数据在软件激活工作流期间以进程内存中的明文形式 存储。 在许可证激活过程中，应用程序生成并处理设备绑定的许可证密钥 ，这些密钥旨在针对特定机器验证软件安装。然而，这些值在没有适当保护或安全内存处理机制的情况下分配到进程内存中。 因为这些值以明文形式...
WordPress Restaurant Menu and Food Ordering plugin < 2.4.12 - Unauthenticated Payment Bypass vulnerability
Unauthenticated Payment Bypass vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Restaurant Menu by MotoPress versions 2.4.12...
CVE-2026-84044
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...
CVE-2026-84044 Restaurant Menu and Food Ordering < 2.4.12 - Unauthenticated Payment Bypass via Forged PayPal IPN
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...
CVE-2026-84044
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 fails to verify that a PayPal Instant Payment Notification (IPN) genuinely originates from PayPal. This allows unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without maki...
EUVD-2026-70992
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...
CVE-2026-73400
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...
CVE-2026-73400 WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...
EUVD-2026-60806
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...
CVE-2026-73400
CVE-2026-73400 is an unauthenticated Local File Inclusion (LFI) vulnerability in the WordPress plugin Restaurant Menu by MotoPress , affecting versions 2.4.11 and below . The flaw allows a remote, unauthenticated attacker to include and read local files on the server, potentially leading to full ...
CVE-2026-73400
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...
PT-2026-77120
Name of the Vulnerable Software and Affected Versions Restaurant Menu by MotoPress versions prior to 2.4.12 Description An unauthenticated Local File Inclusion LFI exists, which allows a remote attacker to read files from the server without requiring user interaction. Local File Inclusion is a...
