Quadz School Management System 3.1 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Quadz School Management System v3.1 - SQL Injection Google Dork: N/A Date: 12.02.2017 Vendor Homepage: http://awardcorporation.com/ Software Buy: https://codecanyon.net/item/quadz-school-management-system/10452009 Demo:...

CVE-2016-8359

An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware...

CVE-2016-8347

An issue was discovered in Kabona AB WebDatorCentral WDC application prior to Version 3.4.0. WDC does not limit authentication attempts that may allow a brute force attack method...

Cross site scripting

An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware...

CVE-2016-8350

An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware...

Design/Logic Flaw

An issue was discovered in OmniMetrix OmniView, Version 1.2. Insufficient password requirements for the OmniView web application may allow an attacker to gain access by brute forcing account passwords...

CVE-2016-8359

An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware...

CVE-2016-5801

CVE-2016-5801 affects OmniMetrix OmniView (Version 1.2). Root cause: weak password requirements allow brute-forcing credentials over HTTP, enabling remote access. Impact per sources: credential compromise could enable control of associated backup generators. Mitigation details in public documents...

CVE-2016-5801

An issue was discovered in OmniMetrix OmniView, Version 1.2. Insufficient password requirements for the OmniView web application may allow an attacker to gain access by brute forcing account passwords...

CVE-2016-8359

An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E1212, firmware Version V2.4 and prior, ioLogik E1213, firmware Version V2.5 and prior, ioLogik E1214, firmware Version V2.4 and prior, ioLogik E1240, firmware...

CVE-2016-8359

CVE-2016-8359 affects Moxa ioLogik E1200 series and E2200 series devices (various firmware versions prior to updated releases). The issue is Cross-site Scripting due to the web application not sanitizing user input, potentially allowing an attacker to inject script or execute arbitrary code. The ...

TI Online Examination System 2.0 - SQL Injection

Exploit Title: TI Online Examination System v2.0 - SQL Injection Google Dork: N/A Date: 12.02.2017 Vendor Homepage: http://textusintentio.com/ Software Buy: https://codecanyon.net/item/ti-online-examination-system-v2/11248904 Demo: http://oesv2.textusintentio.com/ Version: 2.0 Tested on: Win7 x64...

sarreguemines.brithotel.fr XSS vulnerability

Vulnerable URL: http://sarreguemines.brithotel.fr/mapframe.php?lat=;...

CVE-2016-10215

An issue was discovered in Fastspot BigTree bigtree-form-builder before 1.2. The vulnerability exists due to insufficient filtration of user-supplied data in multiple HTTP POST parameters passed to a "site/index.php/../../extensions/com.fastspot.form-builder/ajax/redraw-field.php" URL. An attacke...

Zigaform - SQL Injection

Zigaform - SQL Injection Exploit Title: Zigaform - PHP Form Builder - Contact & Survey v2.9.1 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://php-form-builder.zigaform.com/ Software Buy: https://codecanyon.net/item/zigaform-php-form-builder-contact-survey/14889427 Demo:...

CLUB-8 EMS - SQL Injection

CLUB-8 EMS - SQL Injection Exploit Title: CLUB-8 EMS - Event Management System - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://rexbd.net/ Software Buy: https://codecanyon.net/item/club8-ems-event-management-system-a-to-z/14067759 Demo: http://ems.rexbd.net/ Version: N/A...

Node.js 模块 node-serialize 反序列化任意代码执行漏洞

原文链接：Exploiting Node.js deserialization bug for Remote Code Execution 有增改 原作者：Ajin Abraham 译：Holic 知道创宇404安全实验室 tl;dr 若不可信的数据传入 unserialize 函数，通过传递立即调用函数表达式（IIFE）的 JavaScript 对象可以实现任意代码执行。 漏洞详情 审计 Node.js 代码时，我正好看到一个名为 node-serialize 的序列号/反序列化模块。下面是一段代码示例，来自网络请求的 cookie 会传递到该模块的 unserialize 函数中。...

JVN#88176589: Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to authentication bypass

AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains an authentication bypass vulnerability. Impact A remote unauthenticated attacker may perform an arbitrary...

JVN#39008927: Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to cross-site request forgery

AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains a cross-site request forgery vulnerability. Impact If a user views a malicious page while logged in,...

JVN#71666779: Hands-on Vulnerability Learning Tool "AppGoat" vulnerable to remote code execution

AppGoat provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a hands-on vulnerability learning tool. Hands-on Vulnerability Learning Tool "AppGoat" for Web Application contains a remote code execution vulnerability. Impact If a user accesses a malicious web page, arbitrary code may b...