The `email` parameter in SCRMS 2023-05-27 1.0 is vulnerable to SQL injection attacks. An attacker can exploit this vulnerability to steal user information, including passwords, from the system.
The Rukovoditel version 3.3.1 is vulnerable to CSV injection. By setting the Firstname field as '=calc|a!z|', an attacker can trigger a CSV injection attack and open the calculator on the admin's computer when the admin exports customers as a CSV file.
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.
The exploit allows an authenticated user to create a new user or group with a malicious payload that triggers a cross-site scripting vulnerability. This can lead to the execution of arbitrary code or the stealing of sensitive information.
This module exploits the broken access control vulnerability in Seagate Central External NAS Storage device. Subject product suffers several critical vulnerabilities such as broken access control. It makes it possible to change the device state and register a new admin user which is capable of SSH access.
This code is written in python and helps to create an admin account on ulicms-2023.1-sniffing-vicuna
The Zenphoto 1.6 application is vulnerable to multiple stored Cross-Site Scripting (XSS) attacks. These vulnerabilities allow an attacker to inject malicious scripts into various parts of the application, which can lead to unauthorized access or information disclosure.
The WBCE CMS version 1.6.1 is vulnerable to multiple stored cross-site scripting (XSS) attacks. An attacker can upload a malicious SVG file containing a script that will be executed when viewed by an authenticated user with administrative privileges. This can lead to the execution of arbitrary code or the theft of sensitive information.
Wondershare NativePush Build 1.0.0.7, which is part of Filmora 12 (Build 12.2.1.2088), is vulnerable to unquoted service paths. This vulnerability allows a local user to escalate their privileges to local admin by replacing the affected executable.
Service Provider Management System v1.0 allows SQL Injection via ID parameter in /php-spms/?page=services/view&id=2. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit the latest vulnerabilities in the underlying database.
Services By CQR
