Arbitrary File Deletion Vulnerability in MLECMS

MLECMS is a PHP MySQL, ASP Access/SQL Server based development , enterprise-oriented , support for multi-language , free , open source CMS, to help business users to quickly build and deploy enterprise-level portal . MLECMS arbitrary file deletion vulnerability , an attacker can use this...

The vulnerability of the web application of the enterprise automation system 1C:Enterprise lies in the lack of measures taken to protect the website structure, allowing attackers to carry out cross-site scripting attacks.

The vulnerability of the 1C:Enterprise web application lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks by sending specially crafted requests...

Laravel Administrator 4 - Unrestricted File Upload (Authenticated)

Exploit title: Laravel Administrator 4 - Unrestricted File Upload Authenticated Author: Victor Campos and Xavi Beltran Contact: [email protected] Exploit Development: https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/ Date: 25/3/2020 Software link:...

vulhub

It is an offensive tool for web application security testing. The repository contains a collection of pre-built vulnerable docker environments, allowing users to test web application security without requiring prior knowledge of docker. The tool is designed to be easy to use, with a simple...

House Rental 1.0 SQL Injection

Exploit Title: House Rental 1.0 - 'keywords' SQL Injection Exploit Author: Bobby Cooke boku & Adeeb Shah @hyd3sec Date: 2020-08-07 Vendor Homepage: https://projectworlds.in Software Link: https://projectworlds.in/wp-content/uploads/2019/06/home-rental.zip Version: 1.0 Tested On: Windows 10 Pro...

The vulnerability in the rConfig network device configuration management web application for the CentOS operating system exists due to the lack of measures taken to neutralize special elements used in the operating system’s command line. This allows an attacker to execute arbitrary commands on the target system.

The vulnerability in the rConfig network device configuration management web application for the CentOS operating system relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute...

VestaCP v0.9.8-26 - (period) Cross Site Web Vulnerability

Document Title: =============== VestaCP v0.9.8-26 - period Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2239 Release Date: ============= 2020-11-24 Vulnerability Laboratory ID VL-ID: ====================================...

nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting

Exploit Title: nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting Date: 24-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.nopcommerce.com/ Version: 4.30 Tested on: Windows 10/Kali Linux CVE: CVE-2020-29475 Stored Cross-site scriptingXSS: Stored XSS, also...

OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting

Exploit Title: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting Date: 24-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/index.php?route=cms/download Version: 3.0.3.6 Tested on: Windows 10/Kali Linux CVE:...

Why Replace Traditional Web Application Firewall (WAF) With New Age WAF?

At present, web applications have become the top targets for attackers because of potential monetization opportunities. Security breaches on the web application can cost millions. Strikingly, DNS Domain Name System related outage and Distributed denial of service DDoS lead a negative impact on...

VTiger v7.0 CRM - 'To' Persistent XSS

Exploit Title: VTiger v7.0 CRM - 'To' Persistent XSS Date: 2020-11-18 Exploit Vulnerability-Lab Vendor Homepage: https://www.vtiger.com/open-source-crm/download-open-source/ Software Link: https://sourceforge.net/projects/vtigercrm/files/ Version: v7.0 Document Title: =============== VTiger v7.0...

Schneider Electric EcoStruxure Building Operation WebReports Cross-Site Scripting Vulnerability (CNVD-2021-29455)

Schneider Electric EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in Schneider Electric EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of...

Vtiger CRM 7.0 Cross Site Scripting

Document Title: =============== VTiger v7.0 CRM - To Persistent Email Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2227 Release Date: ============= 2020-11-18 Vulnerability Laboratory ID VL-ID: ==================================== 2227...

Wonder CMS 3.1.3 Cross Site Scripting

Exploit Title: WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting Date: 20-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.wondercms.com/ Version: 3.1.3 Tested on: Windows 10/Kali Linux Stored Cross-site scriptingXSS: Stored XSS, also known as persistent XS...

Drupal 7.x, 8.x, 9.x RCE Vulnerability (SA-CORE-2020-012) - Linux

Drupal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal";...

Schneider Electric EcoStruxure Building Operation WebReports Cross-Site Scripting Vulnerability

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of user-supplied data. A remote attacker...

WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting

Exploit Title: WonderCMS 3.1.3 - 'content' Persistent Cross-Site Scripting Date: 20-11-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://www.wondercms.com/ Version: 3.1.3 Tested on: Windows 10/Kali Linux CVE: CVE-2020-29233 Stored Cross-site scriptingXSS: Stored XSS, also...

Schneider Electric EcoStruxure Building Operation WebReports 跨站脚本漏洞

EcoStruxure Building Operation WebReports is a web application for creating, viewing and managing reports. A cross-site scripting vulnerability exists in EcoStruxure Building Operation WebReports 1.9 - 3.1. The vulnerability stems from improper validation of user-supplied data. A remote attacker...

Jupyter Notebook redirection vulnerability

Jupyter Notebook is an open source web application that allows you to create and share documents containing live code, equations, visualizations, and narrative text.A redirection vulnerability exists in versions prior to Jupyter Notebook 6.1.5. An attacker can exploit this vulnerability to redire...

IBM Spectrum Protect Operations Center 7.1.x < 7.1.11.000 / 8.1.x < 8.1.10.000 Code Injection Vulnerability

The IBM Spectrum Protect Operations Center running on the remote host is version 7.1.x 7.1.11.000 or 8.1.x 8.1.10.000. It is, therefore, vulnerable to a code injection vulnerability which could allow an unauthenticated, remote attacker to execute arbitrary code on the system. Note that Nessus has...