openSIS SQL Injection Vulnerability (CNVD-2020-50531)

openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the fn parameter in CheckDuplicateStudent.php in openSIS 7.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection attack...

Malicious Package in cordova-plugin-china-picker

Version 1.0.910 of cordova-plugin-china-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.910 of this module is foun...

moziloCMS 2.0 Cross Site Scripting

Exploit Title: moziloCMS 2.0 - Persistent Cross-Site Scripting Authenticated Date: 2020-08-31 Exploit Author: Abdulkadir Kaya Vendor Homepage: https://www.mozilo.de/ Version: 2.0 Tested on: Windows & WampServer 1- Go to following url. http://HOST/PATH/admin/ 2- Login the admin panel. 3- Go to...

Exment Cross-Site Scripting Vulnerability

Exment is a Japanese free data management Web system with a simple structure, pre-existing business templates, and links to multiple types of data to minimize the trouble of searching. It supports windows, mac and linux systems. A cross-site scripting vulnerability exists in Exment v3.6.0 and pri...

CVE-2020-23657

NavigateCMS 2.9 is affected by Cross Site Scripting XSS on module "Configuration."...

Mozilla: Attacker-induced prompt for extension installation

By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious...

XSS vulnerability in Yixing YiFa cms

Yixing Yifa Network Service Co., Ltd. is a company that provides Internet solutions for enterprises, providing a variety of information products and services, such as website construction, WeChat public platform, WeChat marketing, website promotion, website maintenance and operation, domain name...

Nextcloud Desktop Client Cross-Site Scripting Vulnerability

Nextcloud is a suite of client-server software for creating file hosting services and using them.Nextcloud Desktop Client is the Nextcloud desktop client. A cross-site scripting vulnerability exists in Nextcloud Desktop Client 2.6.4. An attacker can exploit this vulnerability via an invalid serve...

The vulnerability of the Knowledge Management component of the SAP NetWeaver software integration platform allows attackers to execute cross-site scripting attacks.

The vulnerability of the Knowledge Management component of the SAP NetWeaver software integration platform is related to the failure to take measures to eliminate script-related tags on web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

theblurb.ca Cross Site Scripting vulnerability OBB-1259335

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

The vulnerability of the Tile Server component of the Oracle Fusion Middleware MapViewer software allows a intruder to gain access to modify, add, or delete data.

The vulnerability of the Tile Server component of the Oracle Fusion Middleware MapViewer visualization software relates to the lack of security measures for the web page structure. Exploiting this vulnerability allows a malicious actor to remotely access and modify, add, or delete data using the...

Destoon B2B Content Management System Backend File Inclusion Vulnerability

DESTOON® B2B Website Management System is an open source B2B e-commerce industry portal solution based on PHP+MySQL. A file inclusion vulnerability exists in the backend of the Destoon B2B content management system, which can be exploited by attackers to gain server administrative privileges...

Exploit for CVE-2015-0273

phpcodz Php Codz Hacking http://www.80vul.com/pch/ What is PHP? PHP is a widely-used general-purpose scripting language that is especially suited for Web development and can be embedded into HTML. If you are new to PHP and want to get some idea of how it works, try the introductory tutorial. Afte...

Stored Cross-Site Scripting Vulnerability in RGCMS Frontend In***.php File

RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS front In.php file exists stored cross-site scripting vulnerability. Attackers can use this...

CVE-2020-4410

IBM Jazz Foundation and IBM Engineering products could allow an authenticated user to send a specially crafted HTTP GET request to read attachments on the server that they should not have access to. IBM X-Force ID: 179539...

Code Execution Vulnerability in CLTPHP Content Management System

CLTPHP Content Management System is a PHP content management system for building websites efficiently. A code execution vulnerability exists in CLTPHP Content Management System, which can be exploited by attackers to gain server privileges...

IBM Intelligent Operations Center Cross-Site Scripting Vulnerability (CNVD-2020-50797)

IBM Intelligent Operations Center IOC is a suite of city operations solutions from IBM in the United States. The product features data visualization and real-time collaboration. A cross-site scripting vulnerability exists in IBM Intelligent Operations Center, which can be exploited by an attacker...

Command Execution Vulnerability in ZZCMS

ZZCMS is an asp language development of the site building system. ZZCMS has a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands to obtain server control privileges...

SQL Injection Vulnerability in LJCMS of Beijing Liangjing Zhicheng Technology Co.

LJCMS adopts PHP + Mysql architecture, is a very SEO friendly, full-featured, safe and stable, support multi-terminal display and extremely simple to use enterprise station building system. LJCMS has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database...

D-Link DIR-816L Cross-Site Scripting Vulnerability

The D-Link DIR-816L is a wireless AC750 dual-band cloud router. A cross-site scripting vulnerability exists in the D-Link DIR-816L. The vulnerability stems from the webinc/js/info.php file printing the RESULT parameter on a web page without applying any output filter. An attacker can exploit this...