The LulieBlog 1.2 version is vulnerable to multiple remote vulnerabilities including admin authentication bypass, file upload, and blind SQL injection. The admin authentication bypass vulnerability allows an attacker to modify articles, create new articles, change admin username and blog title, and change admin email. The file upload vulnerability allows an attacker to upload files to the server. The blind SQL injection vulnerability can be exploited using a Perl script.
The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials
This plugin creates a cf7-international-sms-integration from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.
An unauthenticated attacker can exploit a SQL injection vulnerability in Employee Record Management System 1.2 by sending a malicious request to the forgetpassword.php page. The vulnerable parameter is the 'Email' field, which can be used to inject a malicious payload. By sending the payload to the sqlmap tool, an attacker can retrieve all databases from the system.
Auto car 1.2 is vulnerable to SQL Injection and Cross-Site Scripting. An attacker can exploit this vulnerability by sending a malicious payload to the 'car_title' parameter in the search-cars page. This payload will execute an XPATH query and return the username of the database. An attacker can also exploit the Cross-Site Scripting vulnerability by creating an account and sending a malicious payload in the 'name' parameter of the edit profile page. This will execute a JavaScript alert box in the page.
A stack-based buffer overflow vulnerability exists in the ChangePassword function of WESP SDK (package version 1.2). The vulnerability is caused by improper bounds checking of user-supplied data, which can result in the execution of arbitrary code. An attacker can exploit this vulnerability by supplying a specially crafted argument to the ChangePassword function. This can allow the attacker to execute arbitrary code in the context of the application.
Creascripts creadirectory is prone to multiple input-validation vulnerabilities, inculding SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied data. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
ASPIntranet is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
Exophpdesk is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. An attacker can exploit this issue by sending a maliciously crafted HTTP request to the vulnerable application.
Easy Address Book Web Server is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied data before including it in the format-specifier argument to a formatted-printing function. This issue allows remote attackers to execute arbitrary machine code in the context of the affected server process, facilitating the complete compromise of affected computers. Failed exploit attempts will likely crash the service.
Services By CQR