PHPEMS Online Practice Exam System Exploits Override Access Vulnerability

PHPEMS online mock exam system is developed based on PHP+Mysql, it is a PHP online mock exam system that supports multiple question types and presentation methods. PHPEMS Online Practice Exam System has an override access vulnerability, which can be exploited by an attacker to override the right ...

Joomla! Component Raffle Factory 3.5.2 - SQL Injection

Joomla! Component Raffle Factory 3.5.2 - SQL Injection Exploit Title: Joomla! Component Raffle Factory 3.5.2 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: https://thephpfactory.com/ Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/auction/raffle-factory/...

lagump3terbaru.biz XSS vulnerability

Open Bug Bounty ID: OBB-679598 Description| Value ---|--- Affected Website:| lagump3terbaru.biz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

kurs.if.ua XSS vulnerability

Open Bug Bounty ID: OBB-679455 Description| Value ---|--- Affected Website:| kurs.if.ua Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Navigate CMS 2.8 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: Navigate CMS 2.8 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Vendor: https://www.navigatecms.com/en/home Software: Navigate CMS 2.8 CVE: CVE-2018-17255 Technical Details & Description: A Reflected Cross-Site Scripting web...

canalprojects.info XSS vulnerability

Open Bug Bounty ID: OBB-679160 Description| Value ---|--- Affected Website:| canalprojects.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

LimeSurvey 3.14.7 Cross Site Scripting

Exploit Title: LimeSurvey 3.14.7 - HTML Injection and Stored XSS Date: 2018-09-12 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.limesurvey.org/ Software Link : https://github.com/LimeSurvey/LimeSurvey Software : LimeSurvey 3.14.7 Product Version: 3.14.7 Vulernability Type : Command...

Radan-http service for Linux remote code execute Exploit

Injection into a web application Hack all servers have webapp open port 8088 Ok so the web application attack has 2 steps. 1: Create a new application done with post request to /newappication, 2: Now once we done that we can execute commands inside of it. Usage Info 1 You need to scan ip list wit...

Apache ActiveMQ 5.x < 5.14.0 ActiveMQ Fileserver web application remote code execution (Xbash)

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.14.0. It is, therefore, affected by a remote code execution vulnerability. The Fileserver web application allows remote attackers to upload and execute arbitrary files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

HackerOne: User login page doesn't implement any form of rate limiting

Hi Team, Summary: As a best practice a login page should have a rate limitting just like hackerone.com Vulnerable Request POST /auth/postlogin HTTP/1.1 Host: ctf.hacker101.com User-Agent: Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://ctf.hacker101.com/...

Joomla Component JCK Editor 6.4.4 - parent SQL Injection

Joomla Component JCK Editor 6.4.4 - parent SQL Injection Title: Joomla Component JCK Editor 6.4.4 - 'parent' SQL Injection Date: 2018-09-14 Exploit Author: Hamza Megahed Vendor Homepage:https://www.joomla.org/ Download: https://arkextensions.com/products/jck-editor Version: 6.4.4 Tested on: Ubunt...

e107 < 2.1.9 Multiple Vulnerabilities

e107 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:e107:e107"; if description...

Seagate Personal Cloud Information Disclosure

------------------------------------------------------------------------ Seagate Personal Cloud multiple information disclosure vulnerabilities ------------------------------------------------------------------------ Yorick Koster, September 2017...

U.S. Dept Of Defense: Broken Authentication

Summary: IDOR Description: It is possible to access other user account by changing the parameter 'email' to another valid e-mail, i managed to guess an existing user '███████@███.com' which discloses the ███ Name and Surname. Impact Information Disclosure Step-by-step Reproduction Instructions...

matrixscience.com XSS vulnerability

Open Bug Bounty ID: OBB-675921 Description| Value ---|--- Affected Website:| matrixscience.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

XSS vulnerability in 74cms

74cms is a PHP + MYSQL based on the core development of a set of free + open source professional recruitment system. 74cms has an XSS vulnerability that allows an attacker to insert malicious js code into a page to obtain user cookies and other information, resulting in user hijacking...

Adobe ColdFusion Security Bypass Vulnerability (CNVD-2018-18739)

Adobe ColdFusion is the United States Adobe a dynamic Web server products, which runs CFML ColdFusion Markup Language is a programming language for Web applications. A security bypass vulnerability exists in Adobe ColdFusion. An attacker could exploit the vulnerability to bypass security...

CVE-2018-2464

SAP WebDynpro Java, versions 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting XSS vulnerability...

.NET Framework Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Microsoft .NET Framework processes input. An attacker who successfully exploited this vulnerability could take control of an affected system. To exploit the vulnerability, an attacker would need to be able to upload a specially crafted file to a w...

OData Denial of Service Vulnerability

A denial of service vulnerability exists when OData Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against an OData web application. A remote unauthenticated attacker could exploit this vulnerability by issuing...