111 matches found
๐ ChurchCRM 6.8.0 Unauthenticated Remote Code Execution
This Metasploit module exploits an unauthenticated remote code execution vulnerability in the installation process of ChurchCRM versions 6.8.0 and earlier. By sending a specially crafted POST request to the setup page, an attacker can execute arbitrary commands on the target server. This Metasplo...
CVE-2019-25323
Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the outputtitle parameter. Attackers can craft specially formatted POST requests to the outputtitle parameter to execute arbitrary HTML and...
CVE-2019-25323 Heatmiser Netmonitor 3.03 - HTML Injection
Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the outputtitle parameter. Attackers can craft specially formatted POST requests to the outputtitle parameter to execute arbitrary HTML and...
CVE-2019-25322 Heatmiser Netmonitor 3.03 - Hardcoded Credentials
Heatmiser Netmonitor 3.03 contains a hardcoded credentials vulnerability in the networkSetup.htm page with predictable admin login credentials. Attackers can access the device by using the hard-coded username 'admin' and password 'admin' in the hidden form input fields...
CVE-2019-20527
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter...
ChurchCRM Unauthenticated RCE via Setup Page
ChurchCRM use exploit/multi/http/churchcrm/installunauthrce msf undefinedinstallunauthrce show actions ...actions... msf undefinedinstallunauthrce set ACTION msf undefinedinstallunauthrce show options ...show and set options... msf undefinedinstallunauthrce run This module requires Metasploit:...
EUVD-2024-31726
Malicious code in bioql PyPI...
EUVD-2023-53860
Malicious code in bioql PyPI...
EUVD-2022-46042
Malicious code in bioql PyPI...
EUVD-2021-8062
Malicious code in bioql PyPI...
CVE-2022-4980
General Bytes Crypto Application Server CAS beginning with version 20201208 prior to 20220531.38 backport and 20220725.22 mainline contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL used by the product's default-installation /...
CVE-2025-9599
The CVE-2025-9599 entry concerns itsourcecode Apartment Management System 1.0, with a SQL injection vulnerability in /setting/month_setup.php via the txtMonthName parameter. Multiple connected sources (CNVD, CNNVD, RH Red Hat style, CVE lists, VulnEnrichment, PT-2025-35163) describe an externally...
CVE-2024-29419
There is a Cross-site scripting XSS vulnerability in the Wireless settings under the Easy Setup Page of TOTOLINK X2000R before v1.0.0-B20231213.1013...
CVE-2023-49965
SpaceX Starlink Wi-Fi router Gen 2 before 2023.48.0 allows XSS via the ssid and password parameters on the Setup Page...
๐ ABB Cylon Aspect 3.08.03 login.php Obscure Authentication Bypass
The ABB Cylon Aspect BAS controller allows login using guest:guest, which initiates a web session but restricts access to administrative features by returning an 'Invalid Admin Username and/or Password' message. However, the session is still active and valid within the HMI environment. Despite...
CVE-2024-13337
The Clearfy Cache โ WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.2. This is due to missing or incorrect nonce validation on the 'setup-wbcrclearfy' page. This makes it possibl...
yimioa ๅฎๅ จๆผๆด
yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in yimioa version 2024.07.03 and prior versions, which stems from /oa/setup/setup.jsp contains an improper authorization issue...
Telerik Report Server Auth Bypass
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Telerik Report Server Auth Bypass', 'Description' = %q This module exploits an authentication bypass vulnerability in Telerik Report Server...
Telerik Report Server Auth Bypass
This module exploits an authentication bypass vulnerability in Telerik Report Server versions 10.0.24.305 and prior which allows an unauthenticated attacker to create a new account with administrative privileges. The vulnerability leverages the initial setup page which is still accessible once th...
PT-2024-40021 ยท Passbolt ยท Passbolt
Name of the Vulnerable Software and Affected Versions: passbolt versions prior to 2.11 Description: The issue allows an administrator to craft a user with a malicious first name and last name, using a payload such as '; ?. When the user receives the invitation email and clicks on the setup link,...