CMS Made Simple 2.2.17 Cross Site Scripting

Exploit Title: CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting XSS Application: CmsMadeSimple Version: v2.2.17 Bugs: Stored Xss Technology: PHP Vendor URL: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Date of found: 12-07-2023 Author: Mirabbas...

Webile cross-site scripting vulnerabilities

webileapps Webile is an application from webileapps, Inc. A cross-site scripting vulnerability exists in Webile version 1.0.1, which stems from the parameter newfilename/c of the component HTTP POST Request Handler can lead to cross-site scripting...

Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities

Exploit Title: Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2317 Release Date: ============= 2023-07-04 Vulnerability Laboratory ID VL-ID: ==================================== 2317 Common...

ViaTalk CP - Persistent XSS Web Vulnerability

Document Title: =============== ViaTalk CP - Persistent XSS Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2314 Release Date: ============= 2023-07-20 Vulnerability Laboratory ID VL-ID: ==================================== 2314 Common...

CVE-2023-3722

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

CVE-2023-3722 Avaya Aura Device Services Remote Code Execution

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

CVE-2023-3722

A critical OS command injection vulnerability exists in the Avaya Aura Device Services Web application (version 8.1.4.0 and earlier ). The root cause is an unrestricted file upload feature that allows an unauthenticated attacker to upload malicious PHP files. By exploiting this, an attacker can a...

CVE-2023-3638

In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application...

Design/Logic Flaw

In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application...

CVE-2023-3638

Summary: CVE-2023-3638 affects GeoVision GV-ADR2701 cameras. An attacker could edit the login response to gain access to the camera’s web application, enabling unauthorized login. The vulnerability is exploitable remotely with low attack complexity (CVSS v3.1: 9.8, high impact on confidentiality,...

CVE-2023-3638 GeoVision GV-ADR2701 Improper Authentication

In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application...

Dooblou WiFi File Explorer 1.13.3 Cross Site Scripting

Document Title: =============== Dooblou WiFi File Explorer 1.13.3 - Multiple Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2317 Release Date: ============= 2023-07-04 Vulnerability Laboratory ID VL-ID:...

CVE-2023-3638: Improper Authentication

In GeoVision GV-ADR2701 cameras, an attacker could edit the login response to access the web application...

Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS)

Exploit Title: Backdrop Cms v1.25.1 - Stored Cross-Site Scripting XSS Application: Backdrop Cms Version: v1.25.1 Bugs: Stored Xss Technology: PHP Vendor URL: https://backdropcms.org/ Software Link: https://github.com/backdrop/backdrop/releases/download/1.25.1/backdrop.zip Date of found: 12-07-202...

Blackcat Cms v1.4 - Stored XSS

Exploit Title: Blackcat Cms v1.4 - Stored XSS Application: blackcat Cms Version: v1.4 Bugs: Stored XSS Technology: PHP Vendor URL: https://blackcat-cms.org/ Software Link: https://github.com/BlackCatDevelopment/BlackCatCMS Date of found: 13.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2...

ViaTalk CP - Cross Site Scripting Web Vulnerability

Document Title: =============== ViaTalk CP - Cross Site Scripting Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2313 Release Date: ============= 2023-07-19 Vulnerability Laboratory ID VL-ID: ==================================== 2313...

CVE-2023-3527

A CSV injection vulnerability was found in the Avaya Call Management System CMS Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a...

CVE-2023-3527

CVE-2023-3527 concerns the Avaya Call Management System (CMS) Supervisor web app. The issue is a CSV injection vulnerability where an admin user can input crafted data that, when exported to a CSV file and opened in spreadsheet software (e.g., Excel), may trigger arbitrary command execution on th...

PT-2023-26220

Name of the Vulnerable Software and Affected Versions David Pokorny Replace Word plugin versions = 2.1 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PaulPrinting CMS - Multiple Cross Site Web Vulnerabilities

Document Title: =============== PaulPrinting CMS - Multiple Cross Site Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2285 Release Date: ============= 2023-07-18 Vulnerability Laboratory ID VL-ID: ===================================...