Simple POS 4.0.24 - columns[0][search][value] SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Simple POS 4.0.24 - 'columns0searchvalue' SQL Injection Exploit Author: Renos Nikolaou Software Link: https://codecanyon.net/item/simple-pos-point-of-sale-made-easy/3947976 Vendor Homepage: https://tecdiary.com/ Version: 4.0.24...

Automattic: Stored XSS in Jetpack's Simple Payment Module by Contributors / Authors

Jetpack's implementation of the Simple Payment Module is as follows: A custom post type is registered for each product. When an admin creates a product, a post is internally created and information about the product, such as the price is then stored as post meta information. After the post has be...

daveismyname simple-cms authentication flaw vulnerability

daveismyname simple-cms is a content management system CMS. A security vulnerability exists in daveismyname simple-cms on 2014-03-11 and earlier versions, which stems from adding pages without authentication. An attacker can exploit the vulnerability to add pages...

daveismyname simple-cms cross-site request forgery vulnerability

daveismyname simple-cms is a content management system CMS. A cross-site request forgery vulnerability exists in daveismyname simple-cms version 2014-03-11 and earlier. A remote attacker can exploit this vulnerability to delete arbitrary pages with the help of the admin/?delpage=8 URL...

CVE-2018-15565

An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF...

CVE-2018-15564

An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8...

Cross site request forgery (csrf)

An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8...

Cross site request forgery (csrf)

An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF...

CVE-2018-15564

An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8...

CVE-2018-15565

An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF...

CVE-2018-15564

An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8...

CVE-2018-15564

Summary: daveismyname simple-cms (up to 2014-03-11) contains a CSRF vulnerability that can delete any page via the URL admin/?delpage=8. Impact: page deletion via CSRF; no additional exploit details or affected versions beyond the stated date are provided in the connected documents. Notes: no pat...

CVE-2018-15565

The CVE-2018-15565 entry relates to daveismyname simple-cms where admin/addpage.php does not require authentication, enabling page addition without login and enabling CSRF exploitation. Across connected sources (CNVD-2018-16302, NVD/CVE-2018-15565, PRION) the issue is described as an authenticati...

mangalashtak.com XSS vulnerability

Open Bug Bounty ID: OBB-660914 Description| Value ---|--- Affected Website:| mangalashtak.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection

Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same L...

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection

Universal Media Server 7.1.0 - SSDP Processing XML External Entity Injection Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML...

Universal Media Server 7.1.0 XML Injection

Issue: Out-of-Band XXE in Universal Media Server's SSDP Processing Reserved CVE: CVE-2018-13416 Vulnerability Overview The XML parsing engine for Universal Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same L...

Directory Traversal in node-simple-router

Affected versions of node-simple-router resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...

GHSA-5W8Q-X7HC-JHP6 Directory Traversal in node-simple-router

Affected versions of node-simple-router resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system...

asti (>=0.0.1, <=0.0.5), npm-git-registry (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2017-16083 via node-simple-router (>=0.4.7, <=0.9.4-3)

node-simple-router NPM version =0.4.7, =0.0.1, =1.0.1, =0.1.5, =0.0.1, =0.0.5 Source cves: CVE-2017-16083 Source advisory: OSV:GHSA-5W8Q-X7HC-JHP6...