WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection

WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection Exploit Title: Wordpress Plugin Import Export WordPress Users = 1.3.1 - CSV Injection Exploit Author: Javier Olmedo Contact: @jjavierolmedo Website: https://sidertia.com Date: 2018-08-22 Google Dork:...

Fortinet FortiNAC Cross-Site Scripting Vulnerability

Fortinet FortiNAC is a set of network access control solutions from the U.S. company Fita Fortinet. The product is mainly used for network access control and IoT security. A cross-site scripting vulnerability exists in Fortinet FortiNAC. The vulnerability stems from the lack of proper validation ...

Django CRM 0.2.1 Cross Site Request Forgery

Information -------------------- Advisory by Netsparker Name: Multiple CSRF Vulnerabilities in Django CRM 0.2.1 Affected Software: Django CRM Affected Versions: 0.2.1 Homepage: https://github.com/MicroPyramid/Django-CRM Vulnerability: Cross-site Request Forgery Severity: 8.8 High Status: Not Fixe...

WordPress democracy-poll plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. democracy-poll is an online poll plugin used in it. A cross-site request forgery vulnerability exists in the WordPress democracy-poll...

MantisBT Cross-Site Scripting Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. MantisBT suffers from a cross-site scripting vulnerability. The vulnerability stems from the lack of proper validati...

NETGEAR Nighthawk M1 Cross-Site Request Forgery Vulnerability

The NETGEAR Nighthawk M1 is a portable wireless router from NETGEAR. A cross-site request forgery vulnerability exists in the NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a...

onestop.crk.umn.edu Cross Site Scripting vulnerability

Security Researcher Hchabik Helped patch 2352 vulnerabilities Received 5 Coordinated Disclosure badges Received 2 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting onestop.crk.umn.edu website and its users. Following...

DWSurvey Cross-Site Scripting Vulnerability

DWSurvey is a questionnaire system written in Java. A cross-site scripting vulnerability exists in DWSurvey 2019-07-22 and earlier versions, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...

WordPress Meta Box Plugin < 4.16.2 File Upload Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112628";...

afbudsguide.dk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-935769 Security Researcher Renzi Helped patch 6742 vulnerabilities Received 8 Coordinated Disclosure badges Received 36 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting afbudsguide.dk website and it...

Informatica: accounts.informatica.com - RCE due to exposed Groovy console

Researcher identified a misconfigured "Groovy" panel on an AEM web application that was vulnerable to RCE. The panel was subsequently disabled...

Let Experts Do Their Job – Managed WAF by Indusface

WAF Web Application Firewall has been the first line of defence when it comes to application security for a while now. Many organizations have adopted WAF in one form or the other and most cases, compliance has been the driver for adoption. But unfortunately, when it comes to the efficacy of WAF ...

osTicket 1.12 - Persistent Cross-Site Scripting via File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: osTicket-v1.12 Stored XSS via File Upload Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiy...

Apache Ranger Cross-Site Request Forgery Vulnerability

Apache Ranger is a set of architectures from the Apache USA Software Foundation that implement comprehensive security measures for Hadoop clusters. The product provides centralized security policy management for core enterprise security requirements such as authorization, billing and data...

Crunchbase Cognitoys Dino Cross-Site Scripting Vulnerability

Crunchbase Cognitoys Dino is a children's cognitive electronic learning toy from Crunchbase USA. A cross-site scripting vulnerability exists in Crunchbase Cognitoys Dino. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit...

osTicket 1.12 - Persistent Cross-Site Scripting via File Upload

Exploit Title: osTicket-v1.12 Stored XSS via File Upload Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiyer Category: webapps CVE: CVE-2019-14748 1. Descriptio...

NETGEAR EX7000 Cross-Site Scripting Vulnerability

The NETGEAR EX7000 is a wireless router from NETGEAR. A cross-site scripting vulnerability exists in NETGEAR EX7000 version V1.0.0.421.0.94. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to execute...

Joomla! Component JS Jobs (com_jsjobs) 1.2.5 - 'cities.php' SQL Injection

Exploit Title: Joomla! component comjsjobs - SQL Injection Dork: inurl:"index.php?option=comjsjobs" Date: 11.08.19 Exploit Author: qw3rTyTy Vendor Homepage: https://www.joomsky.com/ Software Link: https://www.joomsky.com/5/download/1 Version: 1.2.5 Tested on: Debian/nginx/joomla 3.9.0 Vulnerabili...

osTicket 1.12 - Persistent Cross-Site Scripting

osTicket 1.12 - Persistent Cross-Site Scripting Exploit Title: osTicket-v1.12 Stored XSS Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiyer Category: webapps...

Bagisto Cross-Site Request Forgery Vulnerability

Bagisto is a set of open source e-commerce framework. A cross-site request forgery vulnerability exists in Bagisto version 0.1.5, which stems from a WEB application that does not adequately validate whether a request comes from a trusted user, and can be exploited by an attacker to send an...