15170 matches found
Design/Logic Flaw
A CSV Injection also known as Formula Injection vulnerability in the Marmind web application with version 4.1.141.0 allows malicious users to gain remote control of other computers. By providing formula code in the “Notes” functionality in the main screen, an attacker can inject a payload into th...
vulhub2
It is an offensive tool for web application security training. The primary target product/service or framework is not explicitly stated, but the repository contains various vulnerable environments based on Docker-Compose, including Flask, Apache, Nginx, and others. The vulnerability class/vector ...
CVE-2020-26505
A Stored Cross-Site Scripting XSS vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized...
CVE-2020-26505
A Stored Cross-Site Scripting XSS vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized...
Cross site scripting
A Stored Cross-Site Scripting XSS vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized...
CVE-2020-26505
A Stored Cross-Site Scripting XSS vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized...
CVE-2020-26505
CVE-2020-26505 affects Marmind web application (version 4.1.141.0) and is a stored XSS vulnerability. The issue arises via the Assets Upload function, where an attacker can upload a malicious PDF file containing JavaScript that is later executed in other users’ browsers when they access assets, e...
CVE-2020-26506
An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploaded by administrative users. The accessed files were not visible by the low privileged users in the web GUI...
CVE-2020-26506
An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploaded by administrative users. The accessed files were not visible by the low privileged users in the web GUI...
CVE-2020-26506
The CVE-2020-26506 entry concerns Marmind web application version 4.1.141.0 with an Authorization Bypass allowing lower-privilege users to access files uploaded by administrative users. The accessed files were not visible to low-privilege users in the GUI. The connected documents provide the affe...
tCell by Rapid7 Now Available for the European Region
Today, we are excited to announce tCell by Rapid7, our next-gen WAF and RASP solution, is now available in the Rapid7 Insight cloud’s European region. Multi-national or European organizations with data sovereignty requirements can now leverage tCell to reduce the risk of a breach via hacking of...
bitcoin-abe Cross-Site Scripting Vulnerability
bitcoin-abe is a blockchain browser. The product is able to read bitcoin block files and it supports converting and loading data into a database. A cross-site scripting vulnerability exists in the call in the abe.py file in bitcoin-abe versions 0.7.2 and earlier and 0.8pre and earlier. The...
phpLDAPadmin 0.9.6 - 0.9.7/alpha5 Multiple Vulnerabilities - Active Check
phpLDAPadmin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Multi Restaurant Table Reservation System 1.0 - 'table_id' Unauthenticated SQL Injection
Title: Multi Restaurant Table Reservation System 1.0 - 'tableid' Unauthenticated SQL Injection Exploit Author: yunaranyancat Date: 02-11-2020 Vendor Homepage: www.sourcecodester.com Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/tablereservation.zip Version: 1.0...
Monitorr 1.7.6m - Remote Code Execution (Unauthenticated)
!/usr/bin/python -- coding: UTF-8 -- Exploit Title: Monitorr 1.7.6m - Remote Code Execution Unauthenticated Date: September 12, 2020 Exploit Author: Lyhin's Lab Detailed Bug Description:...
CSE Bookstore 1.0 Cross Site Scripting
Exploit Title: CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting Date: 30/10/2020 Exploit Author: Vyshnav NK Vendor Homepage: https://projectworlds.in/ Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip Version: 1.0 Tested on: Window...
Lot Reservation Management System 1.0 Cross Site Scripting
Exploit Title: lot reservation management system 1.0 - Stored Cross Site Scripting Date: 2020-10-22 Exploit Author: Ankita Pal Vendor Homepage: https://www.sourcecodester.com/php/14530/lot-reservation-management-system-using-phpmysqli-source-code.html Software Link:...
SQL Injection Vulnerability in RaiseDreams Crowdfunding System pr***.aspx File
RaiseDreams crowdfunding system is an enterprise-level crowdfunding website platform for financial tycoons and enterprises that are about to put into crowdfunding ranks, using asp.net+MsSQL database as the system architecture, and the front-end using html5+css3 modern html language to create a...
covid19expeditionspdt.urlweb.pro Cross Site Scripting vulnerability OBB-1460337
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Gym Management System 1.0 Cross Site Scripting
Exploit Title: Gym Management System 1.0 - Stored Cross Site Scripting Date: 21/10/2020 Exploit Author: Jyotsna Adhana Vendor Homepage: https://www.sourcecodester.com/php/14541/gym-management-system-using-phpmysqli-source-code.html Software Link:...