Doctors Appointment Script SQL Injection Vulnerability

Doctors Appointment Script is an apartment booking service website built with HTML5, CSS3, PHP 5 and jQuery. Doctors Appointment Script has a SQL injection vulnerability in several parameters such as lat, lon, category, etc. on the search page, which can be exploited by an attacker to read...

The vulnerability of the Cisco Unified Communications Manager system allows attackers to carry out cross-site scripting attacks.

The vulnerability of the Cisco Unified Communications Manager IP telephony management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to bypass the Cross-Site Scripting XSS filter and perform cross-site...

NetIQ Access Manager Cross-Site Scripting Vulnerability (CNVD-2017-04960)

NetIQ Access Manager NAM is a resource access control solution from NetIQ, USA. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. A cross-site scripting vulnerability exists in NetIQ Access Manager NAM. A remote attacker can...

Stored Cross-Site Scripting Vulnerability in Beijing Topsy's Government Affairs System

Beijing Topsy's government system is an intensive service platform based on cloud PAAS, with all kinds of portal government services, public services as the core, relying on mature big data, cloud computing, mobile Internet, content management, full-text search and other technologies, in accordan...

CVE-2017-7247

Multiple Cross-Site Scripting XSS were discovered in Gazelle before 2017-03-19. The vulnerabilities exist due to insufficient filtration of user-supplied data torrents, size passed to the 'Gazelle-master/sections/tools/managers/multiplefreeleech.php' URL. An attacker could execute arbitrary HTML...

Web and mobile Unified communication platforms(Active UC)remote command execution vulnerability

No description provided by source...

CVE-2017-7202

Multiple Cross-Site Scripting XSS were discovered in SLiMS 7 Cendana before 2017-03-16. The vulnerabilities exist due to insufficient filtration of user-supplied data id passed to the 'slims7cendana-master/template/default/detailtemplate.php' and...

Cisco Prime Service Catalog Cross-Site Scripting Vulnerability (CNVD-2017-03681)

Cisco Prime Service Catalog PSC is a service catalog solution from Cisco that provides all IT services through a single web portal. The solution supports automated ordering of computing, networking, storage, and other data center resources in a unified service catalog. web framework is one of the...

Drupal Services module remote code execution vulnerability (CNVD-2017-03557)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. A remote code execution vulnerability exists in the Services module of Drupal. ...

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (CNVD-2017-03859)

Cisco Unified Communications Manager CUCM, Unified CM is a call-processing component of a unified communications system from Cisco. The component provides a scalable, distributable and highly available enterprise IP telephony call processing solution. A cross-site scripting vulnerability exists i...

Multiple cross-site scripting vulnerabilities in Symantec Web Gateway (CNVD-2017-03683)

Symantec Web Gateway is a spam filter that combines anti-spam, anti-virus, advanced content filtering and data leakage protection technologies from Symantec USA. Multiple cross-site scripting vulnerabilities exist in Symantec Web Gateway that stem from a failure to adequately validate user input...

Microsoft SharePoint Server Cross-Site Scripting Vulnerability (CNVD-2017-04008)

Microsoft SharePoint Server is an integrated suite of server capabilities that provides comprehensive content management and enterprise search, accelerates shared business processes and simplifies information sharing across boundaries. A cross-site scripting vulnerability exists in Microsoft...

Imgur: RCE by command line argument injection to `gm convert` in `/edit/process?a=crop`

Summary The y parameter of /edit/process endpoint with a=crop is vulnerable to command-line argument injection to something that appears to be GraphicsMagick utility probably gm convert. Due to GraphicsMagick's hacker-friendly processing of |-starting filenames supplied to -write option, it leads...

wuhu cross-site scripting vulnerability

Wuhu is a lightweight third-party management system PMS for Gargaj, which is used to help organizational parties with tasks such as collecting entries, managing polls, and communicating information via a large screen. wuhu suffers from a cross-site scripting vulnerability that stems from the...

PYSEC-2017-61

Cross-site scripting XSS vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Entrepreneur B2B Script 2.0.4 - 'id' SQL Injection

Exploit Title: Entrepreneur B2B Script v2.0.4 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/entrepreneur-b2b-script/ Demo: http://www.readymadeb2bscript.com/demo/entre-monicab2b/ Version: 2.0.4...

Honeywell XL Web II Controller Directory Traversal Vulnerability

Honeywell XL Web Controller is a web-based SCADA system. A directory traversal vulnerability exists in Honeywell XL Web II Controller. An unauthenticated user can perform a path traversal attack by accessing a specially crafted URL...

Joomla! Component RealEstateManager 3.9 - SQL Injection

Exploit Title: Joomla! Component RealEstateManager v3.9 - SQL Injection Google Dork: inurl:index.php?option=comrealestatemanager Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy:...

Joomla! Component Directorix Directory Manager 1.1.1 - SQL Injection

Joomla! Component Directorix Directory Manager 1.1.1 - SQL Injection Exploit Title: Joomla! Component Directorix Directory Manager v1.1.1 - SQL Injection Google Dork: inurl:index.php?option=comdirectorix Date: 21.02.2017 Vendor Homepage: http://informafix.fr/ Software Buy:...

Drupal Hotjar Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Hotjar module, which stems from the program failing to properly validate user-supplied input. When an unknowing...