14397 matches found
Command Execution Vulnerability in YXcms
YXcms is a PHP and MySQL based enterprise building content management system CMS. A command execution vulnerability exists in YXcms. An attacker can exploit this vulnerability to gain server privileges...
WoWonder Social Network Platform 3.1 - Authentication Bypass
Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass Date: 11.06.2021 Exploit Author: securityforeveryone.com Researchers : Security For Everyone Team - https://securityforeveryone.com Vendor Homepage: https://www.wowonder.com/ Software Link:...
How to perform a website security check- 6 tools to check website security
By Owais Sultan Running a small business or a large corporation? Your website needs security amid increasing cyberattacks. Here are some website security check tools. This is a post from HackRead.com Read the original post: How to perform a website security check- 6 tools to check website securit...
Stock in & out <= 1.0.4 - Authenticated SQL Injection
The plugin lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection attacks. Users with a role of contributor or higher can exploit this vulnerability...
Infographic: How Are Bad Bots Hurting Your Business?
Bad bots are software applications which run automated tasks with malicious intent over the internet. They scrape data from sites without permission in order to reuse it and gain a competitive edge e.g. pricing, inventory levels, proprietary content, etc.. They are used for scalping, the act of...
All Vulnerabilities for courses.oum.edu.ws Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
MurMurHash - Tool To Calculate A MurmurHash Value Of A Favicon To Hunt Phishing Websites On The Shodan Platform
This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform. What is MurMurHash? MurmurHash is a non-cryptographic hash function suitable for general hash-based lookup. The name comes from two basic operations, multiply MU and rotate R, used i...
UPchieve: Session Hijacking leads to full control of account by attacker
Hi Team , I am Samprit Das MCEH Metaxone Certified Ethical Hacker and a Security Researcher I just checked your website and got a critical vulnerability please read the report carefully. Description:- The Session Hijacking attack consists of the exploitation of the web session control mechanism,...
entrerios.gov.ar Cross Site Scripting vulnerability OBB-2016175
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| entrerios.gov.ar ---|--- Open Bug Bount...
Topcoder: Reflected XSS in https://www.topcoder.com/blog/category/community-stories/
Summary: Reflected XSS in https://www.topcoder.com/blog/category/community-stories/ Note: This is a reflected XSS vulnerability in a hidden input. With that vulnerability, an attacker could write his own code on the website. But with this vulnerability, an attacker also could lead a user, to go o...
A simple guide to keeping customers safe on your website
By Waqas For advice on how to implement proper security measures, below is a guide for keeping customers safe while they’re on your website. This is a post from HackRead.com Read the original post: A simple guide to keeping customers safe on your website...
CVE-2021-32573
CVE-2021-32573 affects express-cart up to version 1.1.10 for Node.js, where Reflected XSS can be triggered via a user input field for product options. The Red Hat advisory and Veracode report corroborate the vulnerability; Veracode notes an attacker with administrative privileges could inject and...
All Vulnerabilities for aulavirtual.invima.gov.co Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| aulavirtual.invima.gov.co ---|--- Open...
Exploit for Unrestricted Upload of File with Dangerous Type in Rocklobster Contact_Form_7
Check-WP-CVE-2020-35489 CVE-2020-35489 The CVE-2020-35489...
All 404 Redirect to Homepage < 1.21 - Authenticated Reflected Cross-Site Scripting (XSS)
The tab parameter of the settings page of the plugin was vulnerable to an authenticated reflected Cross-Site Scripting XSS issue as user input was not properly sanitised before being output in an attribute. PoC...
All 404 Redirect to Homepage < 1.21 - Authenticated Reflected Cross-Site Scripting (XSS)
The tab parameter of the settings page of the plugin was vulnerable to an authenticated reflected Cross-Site Scripting XSS issue as user input was not properly sanitised before being output in an attribute...
Acronis: Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm
Summary The store admin page is accessible without authentication at below URL: http://www.grouplogic.com/ADMIN/store/index.cfm The store admin page provides functionalities such as the following: - Add Edit Items - Search Products - Search Results - Search Orders - Orders Search Results - Add Ne...
Simple Student Information System 1.0 - SQL Injection (Authentication Bypass)
Exploit Title: Simple Student Information System 1.0 - SQL Injection Authentication Bypass Date: 13 April 2021 Exploit Author: Galuh Muhammad Iman Akbar GaluhID Vendor Homepage: https://www.sourcecodester.com/php/11400/simple-student-information-system-ajax-live-search.html Software Link:...
Composr CMS 10.0.36 - Cross Site Scripting
Exploit Title: Composr CMS 10.0.36 - Cross Site Scripting Date: 04/06/2021 Exploit Author: Orion Hridoy Vendor Homepage: https://compo.sr/ Software Link: https://compo.sr/download.htm Version: 10.0.36 Tested on: Windows/Linux CVE : CVE-2021-30150 Vulnerable Endpoint:...
LiveZilla Server 8.0.1.0 - (Accept-Language) Reflected XSS Vulnerability
Exploit Title: LiveZilla Server 8.0.1.0 - 'Accept-Language' Reflected XSS Google Dork: inurl: inurl:/mobile/index.php intitle:LiveZilla Exploit Author: Clément Cruchet Vendor Homepage: https://www.livezilla.net Software Link: https://www.livezilla.net/downloads/en/ Version: LiveZilla Server 8.0.1...