H2 allows users to gain code execution by compiling and running Java code. This exploit utilizes the Java Native Interface to load a Java class without needing to use the Java Compiler.
Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to authenticated remote code execution.
A DLL hijack vulnerability exists in the FJTWSVIC service running as part of the Fujitsu PaperStream IP (TWAIN) software package. This exploit searches for a writable location, copies the specified DLL to that location and then triggers the DLL load by sending a message to FJTWSVIC over the FjtwMkic_Fjicube_32 named pipe.
The Resumes Management and Job Application Website 1.0 allows unauthenticated users to upload resume files. By uploading a PHP file with malicious code, an attacker can execute arbitrary commands on the server and gain unauthorized access. The provided exploit code uploads a PHP file named 'rce.php' containing a command to retrieve the current user's information using the 'whoami' command. When accessing the uploaded file through the URL, the output of the 'whoami' command is displayed.
The WinAVR Version 20100110 software has insecure folder permissions, which allows unauthorized users to modify or delete critical files.
The 'fieldnameDomain' parameter in the WP24 Domain Check plugin for WordPress version 1.6.2 is vulnerable to stored cross-site scripting (XSS) attacks. An attacker can inject malicious JavaScript code into the 'fieldnameDomain' field, which will be executed when the field is focused. This can lead to session hijacking, cookie theft, and other malicious activities.
This vulnerability allows an attacker to inject malicious payloads in the Expense Category section and paste the payload in the desired field. Each time the admin or user visits and manages the user data, the malicious payload (XSS) triggers, allowing the attacker to capture the admin cookies and access the users' data in plain text.
The Meeting Connector Web Console in Zoom Meeting Connector 4.6.239.20200613 allows authenticated users to execute arbitrary commands via shell metacharacters in the Proxy Password field.
The Easy CD & DVD Cover Creator 4.13 software is vulnerable to a denial of service attack. By providing a specially crafted payload, an attacker can cause the application to crash.
A Stored Cross-site scripting (XSS) was discovered in wordpress plugins wp-postratings.1.86. One parameter (postratings_image) has Cross-Site Scripting.
Services By CQR