wp-import-export-lite domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6121insert-headers-and-footers domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6121wp-pagenavi domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home/u918112125/domains/exploit.company/public_html/wp-includes/functions.php on line 6121
The plugin does not properly sanitize the nom, pdf, mp4, webm and ogg parameters, allowing potentially dangerous characters to be inserted. This includes the reported payload, which triggers a persistent Cross-Site Scripting (XSS).
The domain users can be enumerated like userenum module of the kerbrute tool using this exploit. If you conducted a brute-force attack against a user, please run the script after 30 minutes (default settings) otherwise the results can be false positive.
Easy!Appointments < 1.4.3 is vulnerable to an unauthenticated PII (events) disclosure. An attacker can send a specially crafted request to the backend/ajax/get_available_hours endpoint to retrieve events between a given start and end date. The response contains the customer's name, email, phone number and notes.
A command injection vulnerability exists in Zyxel NWA-1100-NH access points with firmware versions prior to 2.12. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the login page of the device. This request contains malicious code in the 'myname' parameter which is then executed on the device.
The WordPress Plugin Motopress Hotel Booking Lite version 4.2.4 is vulnerable to SQL Injection. The vulnerability exists in the sync-urls-repository.php file, where the room_id, sync_id, and calendar_url parameters are vulnerable to SQL injection.
A command injection vulnerability exists in the Razer Sila router. An attacker can send a malicious POST request to the router's ubus service, which allows them to execute arbitrary commands with root privileges. The attacker can send a POST request containing a JSON-RPC call with the command parameter set to the command they wish to execute.
Razer Sila is vulnerable to a Local File Inclusion (LFI) vulnerability. An attacker can send a malicious POST request to the router's ubus service, which will allow the attacker to read any file on the router. This can be used to gain access to sensitive information such as the router's password file.
An arbitrary file deletion vulnerability exists in Telesquare TLR-2855KS6. A remote attacker can send a specially crafted HTTP request to the vulnerable device to delete arbitrary files. This can be exploited to delete critical system files and cause a denial of service.
An arbitrary file creation vulnerability exists in Telesquare TLR-2855KS6. An attacker can send a specially crafted HTTP request to the vulnerable device to create a file with arbitrary content. This could allow an attacker to gain access to the device and execute malicious code.
An Insecure Direct Object Reference (IDOR) vulnerability exists in SAM SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R, which allows an attacker to access unauthorized data by manipulating the username parameter in the request. This can be exploited by sending a specially crafted request with a manipulated username parameter to the vulnerable application.
Services By CQR
