CVE-2018-12921

Electro Industries GaugeTech Nexus devices allow remote attackers to obtain potentially sensitive information via a direct request for the meterinformation.htm, diagsystem.htm, or diagdnplanwan.htm URI...

CVE-2018-12922

Emerson Liebert IntelliSlot Web Card devices allow remote attackers to reconfigure access control via the config/configUser.htm or config/configTelnet.htm URI...

CVE-2018-12923

CVE-2018-12923 : The BWS Systems HA-Bridge devices are vulnerable to an information-disclosure issue where a remote attacker can obtain sensitive information by issuing a direct request to the #!/system URI. The available documents identify this as a vulnerability in the HA-Bridge, describing the...

CVE-2018-12920

The CVE-2018-12920 entry concerns Brickstream 2300 devices. Affected component: the device’s HTTP endpoints exposed via the URIs basic.html#ipsettings and basic.html#datadelivery. Root cause: information disclosure allowing remote attackers to obtain potentially sensitive information by directly ...

CVE-2018-12914

A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI...

Sql injection

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...

CVE-2018-12912

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...

CVE-2018-12914

A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI...

Information disclosure

SAJ Solar Inverter allows remote attackers to obtain potentially sensitive information via a direct request for the inverterinfo.htm or englishmain.htm URI...

Cross site scripting

Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...

Cross site scripting

Reflected Cross-Site Scripting XSS exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI...

CVE-2018-12655

Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...

CVE-2018-12656

Reflected Cross-Site Scripting XSS exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI...

CVE-2018-12655

Reflected Cross-Site Scripting XSS exists in the Circulation module in SLiMS 8 Akasia 8.3.1 via an admin/modules/circulation/loanrules.php?keywords= URI, a related issue to CVE-2017-7242...

CVE-2018-12635

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

Sql injection

NEWMARK aka New Mark NMCMS 2.1 allows SQL Injection via the sectid parameter to the /catalog URI...

CVE-2018-12630

NEWMARK aka New Mark NMCMS 2.1 allows SQL Injection via the sectid parameter to the /catalog URI...

CVE-2018-12630

CVE-2018-12630 affects NEWMARK NMCMS 2.1. The issue is a SQL Injection in the sect_id parameter of the /catalog URI, allowing an attacker to execute arbitrary SQL commands. Impact is high/critical (CVSS3 base 9.8; no auth, network access, no user interaction). Root cause: improper handling of use...

Cross site request forgery (csrf)

An issue was discovered in AKCMS 6.1. CSRF can add an admin account via a /index.php?file=account&action=manageaccounts&job=newaccount URI...

Open a file or URL on the target computer

This module will open any file or URL specified with the URI format on the target computer via the embedded commands such as 'open' or 'xdg-open'. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...