jackson-databind: Serialization gadgets in ibatis-sqlmap

A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

School ERP Pro 1.0 - 'es_messagesid' SQL Injection

Exploit Title: School ERP Pro 1.0 - 'esmessagesid' SQL Injection Date: 2020-04-28 Author: Besim ALTINOK Vendor Homepage: http://arox.in Software Link: https://sourceforge.net/projects/school-erp-ultimate/ Version: latest version Tested on: Xampp Credit: İsmail BOZKURT SQL Injection Detail...

PMB 5.6 - 'logid' SQL Injection

Exploit Title: PMB 5.6 - 'logid' SQL Injection Google Dork: inurl:opaccss Date: 2020-04-20 Exploit Author: 41-trk Tarik Bakir Vendor Homepage: http://www.sigb.net Software Link: http://forge.sigb.net/redmine/projects/pmb/files Affected versions : = 5.6 -==== Software Description ====- PMB is a...

jackson-databind: Serialization gadgets in ibatis-sqlmap

A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

NagiosXL 5.6.11 orderby SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Postauth SQL injection in NagiosXI 5.6.11 param: orderby Vendor: https://www.nagios.com/ Vulnerable software: https://www.nagios.com/downloads/nagios-xi/vmware/ Repo: https://github.com/c610/free/ email protected:$ cat n2.txt GET...

CVE-2020-7356

CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter ‘wayfinderseqid’ in wayfindermeetinginput.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injectin...

Soluzione Globale Ecommerce CMS 1 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Soluzione Globale Ecommerce cms v1 SQL Injection Vulnerability Google Dork: intext:" Soluzione Globale s.r.l.s. " +inurl:/.php?id= Exploit Author: @ThelastVvV Vendor Homepage: https://www.soluzioneglobale.com/ Version: v1 Tested...

Webexcels Ecommerce CMS 2.x SQL Injection / Cross Site Scripting

Exploit Title: Webexcels Ecommerce CMS SQL Injection & XSS Vulnerability Google Dork: intext:intext:" By WEB EXCELS "+inurl:"?Id=" Date: 2020-03-27 Exploit Author: @ThelastVvV Vendor Homepage: https://www.webexcels.com/ Version: 2.x 2017,2018,2019,2020 Tested on: Ubuntu...

Webexcels Ecommerce CMS 2.x SQL Injection / Cross Site Scripting Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Webexcels Ecommerce CMS SQL Injection & XSS Vulnerability Google Dork: intext:intext:" By WEB EXCELS "+inurl:"?Id=" Exploit Author: @ThelastVvV Vendor Homepage: https://www.webexcels.com/ Version: 2.x 2017,2018,2019,2020 Tested...

Soluzione Globale Ecommerce CMS 1 SQL Injection

Exploit Title: Soluzione Globale Ecommerce cms v1 SQL Injection Vulnerability Google Dork: intext:" Soluzione Globale s.r.l.s. " +inurl:/.php?id= Date: 2020-03-24 Exploit Author: @ThelastVvV Vendor Homepage: https://www.soluzioneglobale.com/ Version: v1 Tested on: Ubuntu...

SialWeb CMS eCommerce 1.0 / 1.1 Cross Site Scripting / SQL Injection Vulnerabilities

Exploit for php platform in category web applications Exploit Title: SialWeb CMS SQL Injection & XSS Vulnerability Google Dork: intext:" By Sial Web" +inurl:/.php?id= Exploit Author: @ThelastVvV Vendor Homepage: https://sialweb.net/ Tested on: Ubuntu...

SialWeb CMS eCommerce 1.0 / 1.1 Cross Site Scripting / SQL Injection

Exploit Title: SialWeb CMS SQL Injection & XSS Vulnerability Google Dork: intext:" By Sial Web" +inurl:/.php?id= Date: 2020-03-22 Exploit Author: @ThelastVvV Vendor Homepage: https://sialweb.net/ Tested on: Ubuntu --------------------------------------------------------- PoC 1: The remote sql...

Joomla HDWPlayer 4.2 SQL Injection

Exploit Title: Joomla! comhdwplayer 4.2 - 'search.php' SQL Injection Dork: inurl:"index.php?option=comhdwplayer" Date: 2020-03-23 Exploit Author: qw3rTyTy Vendor Homepage: https://www.hdwplayer.com/ Software Link: https://www.hdwplayer.com/download/ Version: 4.2 Tested on: Debian/Nginx/Joomla!...

MiladWorkShop VIP System 1.0 - 'lang' SQL Injection

Exploit Title: MiladWorkShop VIP System 1.0 - 'lang' SQL Injection Google Dork: Powered By MiladWorkShop VIP System Date: 2020-03-03 Exploit Author: AYADI Mohamed email : [email protected] Vendor Homepage: https://miladworkshop.ir/ Software Link: https://miladworkshop.ir/vip.html Version:...

Persian VIP Download Script 1.0 SQL Injection

Exploit Title: Persian VIP Download Script 1.0 - 'active' SQL Injection Data: 2020-03-09 Exploit Author: S3FFR Vendor HomagePage: http://download.freescript.ir/scripts/Persian-VIP-DownloadFreeScript.ir.zip Version: = 1.0 Final Version Tested on: Windows,Linux Google Dork: N/A...

Debian DLA-2135-1 : jackson-databind security update

The following CVEs were reported for jackson-databind source package. CVE-2020-9546 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig aka shaded hikari-config...

GUnet OpenEclass 1.7.3 E-learning platform - (month) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: GUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL Injection Google Dork: intext:"© GUnet 2003-2007" Exploit Author: emaragkos Vendor Homepage: https://www.openeclass.org/ Software Link:...

CVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap...

CVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap...

UBUNTU-CVE-2020-9547

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig aka ibatis-sqlmap...