Remote code execution

Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable....

The vulnerability of the Apache HTTP server, related to the manipulation of requests on the server side, allows attackers to perform SSRF attacks.

The vulnerability of the Apache HTTP server is related to the manipulation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack by sending specially crafted HTTP requests...

Projectworlds Hospital Management System SQL Injection Vulnerability

Projectworlds Hospital Management System is a hospital management system from Projectworlds Austria. version 1.0 of Projectworlds Hospital Management System is vulnerable to SQL injection, which can be exploited by attackers to compromise database system and in some cases use this vulnerability t...

The vulnerability of the WISE-4060 Ethernet module’s microprogramming software, related to shortcomings in password change procedures via the web server, allows a hacker to gain full access to the device with administrator privileges.

The vulnerability of the WISE-4060 Ethernet module’s microprogramming software is related to deficiencies in the password change process via the web server. Exploiting this vulnerability could allow an attacker to gain full access to the device with administrator privileges...

The vulnerability of the web-server of the programmable logic controller ioLogik, related to buffer overflow in the stack, allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the web-server-based programmable logic controller ioLogik is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code using a specially crafted request...

CVE-2021-40358

A vulnerability has been identified in SIMATIC PCS 7 V8.2 All versions, SIMATIC PCS 7 V9.0 All versions V9.0 SP3 UC04, SIMATIC PCS 7 V9.1 All versions V9.1 SP1, SIMATIC WinCC V15 and earlier All versions V15 SP1 Update 7, SIMATIC WinCC V16 All versions V16 Update 5, SIMATIC WinCC V17 All versions...

Sql injection

A SQL injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the id parameter to the announcementsstudent.php web page. As a result a malicious user can extract sensitive data from the web server and in some cases use this vulnerability in order to get a remote code...

The vulnerability in the embedded web-server microprogramming software of controllers APOGEE MBC, APOGEE MEC, APOGEE PXC, and TALON TC allows a perpetrator to execute arbitrary code.

The vulnerability in the embedded web-server microprogramming software of controllers such as APOGEE MBC, APOGEE MEC, APOGEE PXC, and TALON TC relates to the escape of operations beyond the buffer in memory when processing the Host parameter in HTTP requests. Exploiting this vulnerability allows ...

Command injection

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands...

CVE-2021-3351

OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page...

CVE-2021-22706

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions...

The vulnerability of the Content-Length header in the Apache Traffic Server web server allows a hacker to compromise the integrity of the protected information.

The vulnerability of the Content-Length header in the Apache Traffic Server web server is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...

MOXA NPort IAW5000A-I/O Series 操作系统命令注入漏洞

MOXA NPort IAW5000A-I/O Series is a wireless device server for use in industrial environments from MOXA, China. The server integrates field serial devices with wireless Ethernet networks and incorporates digital IOs for industrial data acquisition applications. The NPort IAW5000A-I/O Series suffe...

Command Execution Vulnerability in HadSky

HadSky is an original open source php light forum community blog program source code. A command execution vulnerability exists in HadSky. An attacker can exploit this vulnerability to gain control of the web server...

MesaLabs AmegaView Command Injection Vulnerability (CNVD-2021-39559)

MesaLabs AmegaView is a continuous monitoring system CMS from MesaLabs USA. A command injection vulnerability exists in MesaLabs AmegaView version 3.0 and prior versions. An attacker can exploit this vulnerability to execute commands in the web server...

3S-Smart Software Solutions CODESYS V2 Web-Server Out-of-Bounds Write Vulnerability

3S-Smart Software Solutions CODESYS V2 Web-Server is an application from 3S-Smart Software Solutions, Germany. A web server. An out-of-bounds write vulnerability exists in 3S-Smart Software Solutions CODESYS V2 Web-Server versions prior to 1.1.9.20, which can be exploited by an attacker with a...

CVE-2021-30194

CODESYS V2 Web-Server before 1.1.9.20 has an Out-of-bounds Read...

UPchieve: Session Hijacking leads to full control of account by attacker

Hi Team , I am Samprit Das MCEH Metaxone Certified Ethical Hacker and a Security Researcher I just checked your website and got a critical vulnerability please read the report carefully. Description:- The Session Hijacking attack consists of the exploitation of the web session control mechanism,...

Cross-site Scripting (XSS) - Reflected in thecoshman/http

✍️ Description The web server is vulnerable to Cross-site scripting. An attacker can host a file with an XSS payload as the file name. When a user visits the web server address, the javascript will be executed in the browser. This is due to improper sanitization. 🕵️‍♂️ Proof of Concept - Create a...

Sifchain: Vulnerable for clickjacking attack

Summary: Hii Team, I know that I have reported to you outside of Scope. The report is related to the mentioned company and the vulnerability can endanger your business so I report this vulnerability to you. Clickjacking User Interface redress attack, UI redress attack, UI redressing is a maliciou...