wp-import-export-lite domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6121insert-headers-and-footers domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6121wp-pagenavi domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6121
WinterCMS < 1.2.3 lacks restrictions on uploading SVG files as website logos, making it vulnerable to a Persistent cross-site scripting (XSS) attack. This vulnerability arises from the ability of an attacker to embed malicious JavaScript content within an SVG file, which remains visible to all users, including anonymous visitors. Consequently, any user interaction with the affected page can inadvertently trigger the execution of the malicious script
The Admidio application version 4.2.10 is vulnerable to remote code execution (RCE). An attacker can exploit this vulnerability by uploading a malicious .phar file in the image upload section of the Announcements feature. The uploaded file can contain PHP code that executes system commands, allowing the attacker to execute arbitrary commands on the server. This can lead to unauthorized access, data theft, and further compromise of the system.
This exploit allows an attacker to bypass authentication in Cisco UCS-IMC Supervisor version 2.2.0.0 and earlier. By sending a specially crafted request to the /app/ui/ClientServlet?apiName=GetUserInfo endpoint, the attacker can gain unauthorized access to the system.
Multiple XSS vulnerabilities in ProjeQtOr Project Management System V10.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cronStatus parameter in refreshCronIconStatus.php, (2) SVG file upload, or (3) destinationWidth parameter in ack.php.
The News Portal v4.0 software is vulnerable to SQL Injection. An attacker can exploit this vulnerability by injecting malicious SQL queries through the 'name' parameter in the 'news-details.php' page. This can lead to unauthorized access to the database and potentially sensitive information leakage.
The XAMPP version 8.2.4 is vulnerable to an unquoted path vulnerability. This vulnerability allows an attacker to escalate their privileges by replacing a legitimate executable file with a malicious one. By exploiting this vulnerability, an attacker can execute arbitrary code with elevated privileges.
The Game Jackal Server v5 software on Windows 10 Pro has an unquoted service path vulnerability, which allows local attackers to gain elevated privileges via a Trojan horse executable file in the %SYSTEMDRIVE% folder.
The AVG Anti-Spyware 7.5 software on Windows 10 Pro has an unquoted service path vulnerability, which allows local users to gain privileges via a crafted executable file in the %SYSTEMDRIVE% folder.
Authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the Titan File video transcoding software. The application parses user supplied data in the job callback url GET parameter. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP/DNS/File request to an arbitrary destination. This can be used by an external attacker for example to bypass firewalls and initiate a service, file and network enumeration on the internal network through the affected application.
An attacker can inject malicious JavaScript code through the vulnerable parameter (mc=) in the URL. This can lead to execution of arbitrary code in the victim's browser.
Services By CQR
