School ERP Ultimate 2018 - 'fid' SQL Injection

Exploit Title: School ERP Ultimate 2018 - 'fid' SQL Injection Dork: N/A Date: 2018-10-21 Exploit Author: Ihsan Sencan Vendor Homepage: http://freeschoolerp.com/ Software Link: http://freeschoolerp.com/schoolerp30Nov2017free.zip Software Link:...

denver.edgemedianetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-688775 Description| Value ---|--- Affected Website:| denver.edgemedianetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Server Side Request Forgery in svgSalamander

The SVG Salamander aka svgSalamander library, when used in a web application, allows remote attackers to conduct server-side request forgery SSRF attacks via an xlink:href attribute in an SVG file...

GHSA-H3WV-47XM-4MG6 Server Side Request Forgery in svgSalamander

The SVG Salamander aka svgSalamander library, when used in a web application, allows remote attackers to conduct server-side request forgery SSRF attacks via an xlink:href attribute in an SVG file...

8 Popular Courses to Learn Ethical Hacking – 2018 Bundle

Update Oct 2018 — Over 30,000 students from all around the world have joined this training program so far. Due to the growing number of threats in the computer world, ethical hackers have become the most important player for not only governments but also private companies and IT firms in order to...

Zenar Content Management System 8.3 Cross Site Request Forgery

Exploit Title: Zenar Content Management System 8.3 - Cross-Site Request Forgery CSRF Date: 2018-05-21 Exploit Author: Ismail Tasdelen Vendor Homepage: https://zenar.io/ Software Link : https://github.com/TribalSystems/Zenario/releases/tag/8.3.47997 Software : Zenar Content Management System 8.3...

Oracle BI Publisher Code Execution Vulnerability (cpuoct2018)

Oracle BI Publisher is prone to a code execution vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache Tomcat unauthorized access vulnerability

The URL pattern of "" the empty string which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It...

Chaturbate: Stored XSS on chaturbate.com (wish list)

Hi, I found a stored XSS on chaturbate.com Description The input wishlist in the bio of a user allows him/her to enter CSS properties, however some browsers like Opera or Internet Explorer are vulnerable to XSS through the attribute style. request http POST /accounts/editbio/ HTTP/1.1 Host:...

CVE-2018-18436

JTBCPHP 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URI...

Time and Expense Management System 3.0 - Cross-Site Request Forgery (Add Admin)

Time and Expense Management System 3.0 - Cross-Site Request Forgery Add Admin Exploit Title: Time and Expense Management System 3.0 - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-17 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.initechs.com/ Software Link:...

Time and Expense Management System 3.0 - CSRF (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: Time and Expense Management System 3.0 - Cross-Site Request Forgery Add Admin Exploit Author: Ihsan Sencan Vendor Homepage: http://www.initechs.com/ Software Link: http://sourceforge.net/projects/tems/files/latest Version: 3.0...

Time and Expense Management System 3.0 - Cross-Site Request Forgery (Add Admin)

Exploit Title: Time and Expense Management System 3.0 - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-17 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.initechs.com/ Software Link: http://sourceforge.net/projects/tems/files/latest Version: 3.0 Category: Webapps Tested on:...

CVE-2018-14772

Pydio (formerly AjaXplorer) versions 4.2.1 through 8.2.1 are affected by an authenticated remote code execution vulnerability. An attacker with administrator access to the web application can trigger arbitrary code execution on the underlying system via Command Injection. Affected component is th...

Kados R10 GreenBee - release_id SQL Injection

Kados R10 GreenBee - releaseid SQL Injection Exploit Title: Kados R10 GreenBee - 'releaseid' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.kados.info/ Software Link: https://sourceforge.net/projects/kados/ Version: R10 GreenBee Category: Webapp...

Academic Timetable Final Build 7.0 - Information Disclosure Exploit

Exploit for php platform in category web applications \n"; printr$ver; echo "\n"; / Array sEcho = 10 iTotalRecords = 3 iTotalDisplayRecords = 3 aaData = Array 0 = Array 0 = testdb1 1 = testdb1 2 = ADMIN 3 = 6CC4E8CFFEAF202D7475BC906612F9A29A9C8117 1 = Array 0 = ADMIN 1 = admin...

College Notes Management System 1.0 - user SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: College Notes Management System 1.0 - 'user' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://anirbandutta.ml/ Software Link: https://sourceforge.net/projects/college-notes-management/ Software Link:...

College Notes Management System 1.0 SQL Injection

Exploit Title: College Notes Management System 1.0 - 'user' SQL Injection Dork: N/A Date: 2018-10-15 Exploit Author: Ihsan Sencan Vendor Homepage: https://anirbandutta.ml/ Software Link: https://sourceforge.net/projects/college-notes-management/ Software Link:...

Academic Timetable Final Build 7.0 - Information Disclosure

\n"; printr$ver; echo "\n"; / Array sEcho = 10 iTotalRecords = 3 iTotalDisplayRecords = 3 aaData = Array 0 = Array 0 = testdb1 1 = testdb1 2 = ADMIN 3 = 6CC4E8CFFEAF202D7475BC906612F9A29A9C8117 1 = Array 0 = ADMIN 1 = admin 2 = ADMIN 3 = 4ACFE3202A5FF5CF467898FC58AAB1D615029441...

Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin)

Academic Timetable Final Build 7.0b - Cross-Site Request Forgery Add Admin Exploit Title: Academic Timetable Final Build 7.0b - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://geoffpartridge.net/ Software Link:...