FiyoCMS check_file.php file exists arbitrary file read hole

FiyoCMS is a content management system CMS for creating CMS templates. An arbitrary file read hole exists in the FiyoCMS checkfile.php file. An attacker can exploit the hole to read arbitrary files on the server...

Multiple Cross-Site Scripting Vulnerabilities in Synology Chat

Synology Chat is an enterprise messaging service that runs on Synology NAS. The solution eliminates the need for users to compose emails and improves the efficiency of corporate communication. Multiple cross-site scripting vulnerabilities exist in Slash Command Creator in Synology Chat. A remote...

Red Hat CloudForms HTML Injection Vulnerability

Red Hat CloudForms is a suite of IaaS Infrastructure as a Service cloud service solutions from Red Hat, Inc. The solution creates and manages private and public clouds and has the ability to manage the application lifecycle. An HTML injection vulnerability exists in Red Hat CloudForms, which stem...

PHP Scripts Mall Car Rental Script SQL Injection Vulnerability (CNVD-2018-00484)

PHP Scripts Mall Car Rental Script is an open source website script for cab booking owners and agents. PHP Scripts Mall Car Rental Script suffers from a SQL injection vulnerability. The vulnerability can be exploited to conduct SQL injection attacks via the carid parameter in admin/carlistedit.ph...

Reflective Cross-Site Scripting Vulnerability in TRS MAS infogate Plugin of Beijing Tops Information Technology Co.

TRS MAS is a universal media management system based on the characteristics of audio and video usage in the mobile Internet era. There is a reflective cross-site scripting vulnerability in the TRS MAS infogate plugin of Beijing Tops Information Technology Co. The vulnerability is due to the...

The vulnerability of the “index.php” script in the microprogramming software for network storage devices from Western Digital MyCloud NAS allows for the execution of arbitrary commands.

The vulnerability of the “index.php” script in the microprogramming software of Western Digital MyCloud NAS is related to the lack of measures taken at the management level to clean up data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially...

Ecava IntegraXor SQL Injection Vulnerability (CNVD-2017-37693)

Ecava IntegraXor is a toolset for creating and running human-machine interfaces for Web-based SCADA systems. Ecava IntegraXor suffers from a SQL injection vulnerability that can be exploited by an attacker to compromise an application, access or modify data, or exploit a potential vulnerability i...

CVE-2017-17619

Laundry Booking Script 1.0 has SQL Injection via the /list city parameter...

CVE-2017-17615

Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter...

CVE-2017-17574

FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter...

Syhunt ScanTools 6.0 - Console Web Vulnerability Scan Tools

Syhunt ScanTools 6.0 adds advanced fingerprinting capabilities, enhanced spidering, injection and code scan capabilities, and a large number of improved checks. Adds the display of Hybrid, Dynamic and Code detailed scan statistics to the command-line tools. New fingerprinting capabilities - Becau...

CVE-2017-14186

A Cross-site Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4 and below versions under SSL VPN web portal allows a remote user to inject arbitrary web script or HTML in the context of the victim's browser via the login redir parameter. An URL Redirection attack...

IBM Rational DOORS Next Generation Cross-Site Scripting Vulnerability

IBM Rational DOORS Next Generation captures, tracks, analyzes and manages requirements while maintaining compliance with industry standards and regulations. A cross-site scripting vulnerability exists in IBM Rational DOORS Next Generation, which allows remote attackers to exploit the vulnerabilit...

IBM Rational DOORS Next Generation Cross-Site Scripting Vulnerability (CNVD-2017-37837)

IBM Rational DOORS Next Generation DNG and Rational Requirements Composer RRC are both requirements management solutions from IBM USA. The solutions are primarily used to define, manage, and report on requirements throughout the project lifecycle. A cross-site scripting vulnerability exists in IB...

b3log Symphony Cross-Site Scripting Vulnerability

b3log Symphony aka Sym is an open source set of modern community platforms written in the Java language, including forums, BBS, SNS and blogs. A cross-site scripting vulnerability exists in b3log Symphony version 2.2.0. A remote attacker can exploit this vulnerability by sending a specially craft...

SQL injection vulnerability in YxtCMF frontend ShitiController.class.php page

YxtCMF Yi Xue Tang Online Learning System is an online learning platform system developed with thinkphp+bootstrap as the framework. A SQL injection vulnerability exists in the YxtCMF frontend ShitiController.class.php page. The vulnerability is due to the system failing to effectively filter...

testedich.de XSS vulnerability

Vulnerable URL: http://www.testedich.de/search.php3?quiz=toto%22%3E%0D%0A%3Cimg/src=%22x%22%20onerror=%22document.writeString.fromCharCode60,115,99,114,105,112,116,62,97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,100,111,109,97,105,110,41,60,47,115,99,114,105,112,116,62%22%3E%3C!--...

CVE-2017-16765

XSS exists on D-Link DWR-933 1.00WWB17 devices via cgi-bin/gui.cgi...

Vonage HT802 Cross-Site Scripting Vulnerability

The Vonage Grandstream HT802 devices is a home gateway device from Vonage USA. A cross-site scripting vulnerability exists in /cgi-bin/config2 on Vonage Grandstream HT802 devices. A remote user can exploit the vulnerability to inject arbitrary web script or HTML via the DHCP vendor class ID field...

Apache jUDDI Cross-Site Scripting Vulnerability

Apache jUDDI is the United States Apache Apache Software Foundation of a Java-based , open source follow the UDDI standard application . A cross-site scripting vulnerability exists in versions of Apache jUDDI prior to 2.0. A remote attacker can exploit this vulnerability by sending the 'dsname'...