Results
17,305· Page 116/347Indexhibit 2.1.5 allows a product reinstallation, with resultant remote code execution, via /ndxzstudio/install.php?p=2.
ifw8 Router ROM v4.31 allows credential disclosure by reading the action/usermanager.htm HTML source code.
s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.
NIUSHOP V1.11 has CSRF via search_info to index.php.
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI.
FlameCMS 3.3.5 has SQL injection in account/login.php via accountName.
SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode ch
In MobaXterm 11.1 and 12.1, the protocol handler is vulnerable to command injection. A crafted link can trigger a popup
A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through 1.1.0 produces code that uses an
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be inje
Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command,
Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30,
A command injection vulnerability is present in the web management interface of ArubaOS that permits an authenticated us
Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS
The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS comma
A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). An attacker with administ
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some parts of the web app
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). Some pages that should on
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0 SP1). The web interface has no
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https reque
CODESYS V3 web server, all versions prior to 3.5.14.10, allows an attacker to send specially crafted http or https reque
A vulnerability has been identified in SIMATIC TDC CP51M1 (All versions < V1.1.7). An attacker with network access to th
A remote code execution vulnerability is present in network-listening components in some versions of ArubaOS. An attacke
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long p
The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item para
On Tenda N301 wireless routers, a long string in the wifiSSID parameter of a goform/setWifi POST request causes the devi
DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Tri
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' proce
In the Linux kernel through 5.2.14 on the powerpc platform, a local user can read vector registers of other users' proce
admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_
admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mai
A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page.
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality ava
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-ad
The cysteme-finder plugin before 1.4 for WordPress has unrestricted file upload because of incorrect session tracking.
The Neosense theme before 1.8 for WordPress has qquploader unrestricted file upload.
The Headway theme before 3.8.9 for WordPress has XSS via the license key field.
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page p
The fs-shopping-cart plugin 2.07.02 for WordPress has SQL injection via the pid parameter.
The sirv plugin before 1.3.2 for WordPress has SQL injection via the id parameter.
The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization.
The Post Indexer plugin before 3.0.6.2 for WordPress has incorrect handling of data passed to the unserialize function.
The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin.
The wp-d3 plugin before 2.4.1 for WordPress has CSRF.
PicoC 2.1 has a heap-based buffer overflow in StringStrcpy in cstdlib/string.c when called from ExpressionParseFunctionC
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
Test your stack for 2019issues
CyberStrike tests your own apps and APIs, then verifies each finding before you see it.