SQL Injection Vulnerability in SemCMS SE***_In***.php File

SemCMS is a set of open source foreign trade enterprise website management system, written in php language, can be run under window or linux system. SemCMS SEIn.php file has a SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive information in the database...

IceHrm Cross-Site Request Forgery Vulnerability

IceHrm is a human resource management Hrm system. The system includes features such as employee management, leave management and payroll management. A cross-site request forgery vulnerability exists in IceHrm version 26.2.0. The vulnerability stems from the WEB application not adequately verifyin...

Lexmark Printer XSS Vulnerability (TE933)

A stored cross-site scripting vulnerability has been identified in some Lexmark devices. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Thi...

Cross-Site Scripting Vulnerability in Multiple Microsemi Products

Microsemi Symmetricom SyncServer S100 and others are a network time server from Microsemi, USA. A cross-site scripting vulnerability exists in several Microsemi products. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit...

Design/Logic Flaw

LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognize...

CVE-2020-7959

LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database name. An attacker might be able to enumerate database names by providing his own database name in a request, because the response will return an 'Unrecognize...

The vulnerability of the Oracle iSupport web application allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Oracle iSupport web application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTPS protocol...

Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User) Vulnerability

Exploit for php platform in category web applications Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery Add User Exploit Author: J3rryBl4nks Vendor Homepage: https://icehrm.com/ Software Link: https://sourceforge.net/projects/icehrm/Version 26.2.0 Tested on Windows 10/Kali Rolling The Ic...

Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2020-10427)

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in Revive Adserver. The vulnerability stems from the lack of prope...

Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)

Ice HRM 26.2.0 - Cross-Site Request Forgery Add User Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery Add User Date: 2020-02-14 Exploit Author: J3rryBl4nks Vendor Homepage: https://icehrm.com/ Software Link: https://sourceforge.net/projects/icehrm/Version 26.2.0 Tested on Windows 10/Kal...

The vulnerability of the Oracle iSupport web application allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Oracle iSupport web application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTPS protocol...

Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)

Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery Add User Date: 2020-02-14 Exploit Author: J3rryBl4nks Vendor Homepage: https://icehrm.com/ Software Link: https://sourceforge.net/projects/icehrm/Version 26.2.0 Tested on Windows 10/Kali Rolling The Ice HRM Web Application is vulnerable t...

phpMyChat Plus 1.98 - (pmc_username) SQL Injection Vulnerability

Exploit for php platform in category web applications Title: phpMyChat Plus 1.98 - 'pmcusername' SQL Injection Exploit Author: J3rryBl4nks Vendor Homepage: http://ciprianmp.com/latest/ Software Link: https://sourceforge.net/projects/phpmychat/files/phpMyChatPlus/ Version MyChat Plus 1.98 Tested o...

CHIYU BF430 TCP IP Converter Cross-Site Scripting Vulnerability

CHIYU BF-430 is a networking server that provides communication for access control, time and attendance system and other devices from CHIYU Technology CHIYU in Taiwan, China. A cross-site scripting vulnerability exists in CHIYU BF-430 232/485 TCP/IP Converter versions prior to 1.16.00. The...

Wowza Streaming Engine Code Execution Vulnerability

Wowza Streaming Engine is a streaming media server software from Wowza Media Systems. The program supports live streaming, VOD, online video chat, and remote recording. A security vulnerability exists in Wowza Streaming Engine. The vulnerability stems from the lack of proper validation of client...

Lexmark printer cross-site scripting vulnerability

Lexmark printers is a printer product of Lexmark USA. A cross-site scripting vulnerability exists in the Lexmark printer MS812 and several previous series printers. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

Piwigo < 2.10.2 Multiple Vulnerabilities

Piwigo is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2014-2595

Barracuda Web Application Firewall WAF 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string...

ASUS WRT-AC66U Cross-Site Scripting Vulnerability (CNVD-2020-04914)

The ASUS WRT-AC66U is a product of Asus Taiwan, China. A cross-site scripting vulnerability exists in the ASUS WRT-AC66U. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

CVE-2020-8429

The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs...