A Reflected Cross-site scripting (XSS) vulnerability in Jenzabar v9.2.0 through 9.2.2. Attacker could inject web script or HTML via the query parameter (aka the Search Field). To exploit the vulnerability, someone must click the link.
The application stores sensitive information in an unencrypted XML file called /config/server.xml. A local attacker that has access to the current user session can successfully disclose plain-text credentials that can be used to bypass authentication to the affected server.
An authenticated attacker can execute remote arbitrary Python code after enabling and unlocking the undocumented console module.
The Student Record System 4.0 is vulnerable to SQL injection in the 'cid' parameter. By adding a payload to the URL, an attacker can execute arbitrary SQL queries. The vulnerability can be identified by the delay in the web server's response.
The Zoo Management System 1.0 is vulnerable to an SQL injection in the 'anid' parameter. By adding a specific payload to the URL, an attacker can manipulate the SQL query to perform unauthorized actions. This exploit has been tested on Windows.
The WordPress Plugin SuperForms version 4.9 allows arbitrary file upload, leading to remote code execution. An attacker can upload a malicious file with a .php4 extension to execute arbitrary code on the server. The file can be found in the /wp-content/uploads/superforms/2021/01/<id>/filename.php4 directory, where <id> can be obtained from the server reply.
This exploit allows an attacker to execute arbitrary code remotely on the target system. By sending a specially crafted request to the fuel/pages/select endpoint, the attacker can inject system commands and execute them on the server. The vulnerability affects Fuel CMS version 1.4.1 and earlier. The exploit has been tested on Ubuntu 16.04.
The Openlitespeed WebServer version 1.7.8 is vulnerable to command injection. An attacker with authenticated access can inject a payload in the 'Command' value of the 'External App' configuration, leading to arbitrary command execution with the privileges of the web server. This can allow an attacker to take control of the affected system.
The Tenda AC5 AC1200 wireless router is vulnerable to stored cross site scripting. An attacker can manipulate the WiFi Name parameter with a malicious script, causing it to be executed when the page is refreshed.
The 'user_email' parameter in the userAuthentication function is vulnerable to SQL injection, allowing an attacker to bypass authentication.
Services By CQR