# What is Prophaze AppSec Platform? How it works? Prophaze is built natively on the Kubernetes Platform and secures customer's Kubernetes clusters and cloud infrastructure from various attack vectors. Prophaze AppSec Platform is a cybersecurity tool designed for DevOps teams and cloud providers in manufacturing, healthcare, education, fintech, and cloud ERP sectors. It helps manage Kubernetes deployments and protects web assets from cyber threats, misconfigurations, attacks, bots, and vulnerabilities. Key features of Prophaze AppSec include behavioral analytics, incident management, machine learning, endpoint management, denial-of-service (DDoS) protection, and virtual patching. The Prophaze AI firewall blocks new malware variants, malicious requests, zero-day attacks, and execution of fileless attacks, assisting organizations with API protection, account takeover, web security, bot management, and DDoS prevention. Prophaze AppSec continually updates security policies that include whitelisting, blacklisting, response filtering, virtual patching, and blocking, enabling security teams to automate policies based on specific behaviors and activities of users and applications. The system can be hosted on-premise on Microsoft Azure, AWS, and Google Cloud or set up as a virtual WAF server in private clouds. Prophaze AppSec integrates with the following communications, security information and event management (SIEM), and security monitoring tools and cloud services: * Microsoft Teams * Slack * Splunk * Datadog * Kubernetes * Google Cloud * AWS * Microsoft Azure **How it works?** Prophaze AppSec is a new-generation web application firewall that intelligently tracks down malicious requests into your Web APIs. It uses multiple attack detection algorithms to monitor all the incoming requests and will pass only legitimate requests to the host server. Prophaze logs all packets to the server internally and makes an intelligent analysis based on both dynamic and intelligent threat detection methodologies. It is deployed as depicted in the below figure

# Performance Performance of Prophaze WAF is tested in a simulated environment with single E3 CPU and using highly targeted bandwidth with the following parameters * 14000 requests per second until the whole system was timed out * Each process took 8 MB of memory storage # SSL Termination SSL operations need to be changed to Prophaze WAF itself. It needs to decrypt the encrypted data to get access to HTTP data to identify any known threats in the post content, etc. WAF can then communicate with the server in plain text or SSL. Having a copy of the SSL private key in the WAF can decrypt the encrypted traffic. The original requests and responses are never affected; they reach the web server, where they are separately decrypted. # Modes of Operation Prophaze Web Application Firewall can work in two modes * Learning Mode * Active Mode In Learning Mode, all traffic (except for standard signature-based attacks) is allowed to pass through the server, but all attacks to the host are monitored and stored internally in the WAF. This mode is usually used in the initial stage of installation of WAF. At this time Prophaze WAF learns the target application profile , behaviour of the system , and automatically learns to which resource the access needs to be granted. In Active mode, Prophaze WAF blocks malicious attacks on the server and the corresponding events are logged into the system which is available as reports . In both Active and Learning Mode Prophaze WAF works as a **Reverse Proxy**, where all the requests and response are routed to host server. # Prophaze AppSec Best Practices Prophaze uses Application Profiling to determine the best configuration for your application once you onboard the domain in our dashboard. Hence only minimum intervention is required from the customer. Some configurations the customer can tweak are the following. **1.** **Active Mode** Once the domain is onboarded, WAF goes into an application profiling period where it learns the application, and web attacks are not blocked during this period, it is in detection mode only, this period is required by the WAF to learn the application and reduce the false-positives and to better protect against non-signature-based attacks. The WAF ensures that security breaches do not reach your server by keeping an eye out for them and blocking them while in active mode.

2\. **Bot Protection**- This feature is turned off by default and can be activated when the application faces any bot attacks or is suspecting a DDOS. Prophaze offers various kinds of Bot Protection methods * [x] **Captcha less challenge**- It uses JavaScript to analyze user interactions, like mouse movements and device fingerprints, to distinguish humans from bots seamlessly, ensuring strong bot mitigation without interrupting user experience. Ideal for scenarios prioritizing seamless access, like e-commerce or content-heavy websites, without compromising security. * [x] **Captcha Challenge**- The Captcha Challenge verifies human identity by prompting users to solve a Captcha, preventing automated bots from accessing protected resources. It adds extra security, suitable for login processes or protecting sensitive data, ensuring strict access control and higher assurance of user authenticity in critical applications. * [x] **PhantomJS Challenge**- is a specific bot mitigation technique designed to detect and block traffic coming from headless browsers, like PhantomJS.PhantomJS is a headless browser often used for legitimate purposes like web scraping, automated testing, or crawling. However, it is also commonly misused by attackers to execute automated attacks such as credential stuffing, data scraping, and web application exploitation. PhantomJS operates without a graphical interface, which makes its activities invisible to regular monitoring mechanisms unless advanced detection techniques are in place. * [x] Prophaze's Bot Mitigation feature includes a **whitelist option**, giving you more control over how it identifies and handles traffic. Here's what it means:

**Bot Mitigation:** This feature aims to identify and block automated bots that can harm your website in various ways, such as scraping content, launching Denial-of-Service (DoS) attacks, or attempting account takeovers. **Whitelist:** This is a list of trusted sources (e.g., IP addresses or subnets) that Prophaze will not flag as bots. Traffic originating from these sources will bypass bot mitigation checks and be treated as normal user traffic. **3. Granular control over proxy settings** Within the settings page, users have the flexibility to adjust configurations such as endpoint, proxy-connect-timeout, proxy read timeout, client body size, and can customize HTTP headers and cipher suites according to their specific requirements. Within the Settings Tab, navigate to "Configure Domains'' on the left-hand menu. This section displays all domains currently onboarded on the WAF. To adjust configuration settings for a specific domain, select the "Edit" button (depicted by a pencil symbol) corresponding to the desired domain. A new window will appear.

Below are the parameters that can be set on the newly appeared window- **Endpoint**- Provide the IP address of the server hosting the application. This may also include the IP address of a load balancer or the load balancer itself responsible for serving the application. **Read Timeout**- The read timeout, defined as the maximum wait time to receive a response from the application server, is set to 60 seconds for security compliance. It's recommended to increase this value when the application server experiences slow responses, handles long-running requests, transfers large data, or encounters unpredictable network conditions. This safeguards against premature connection termination, enhancing application reliability, stability, and user experience. **Connect Timeout-** The connect timeout, defined as the maximum duration to establish a connection with the application server, defaults to 60 seconds for security compliance. Consider extending this duration when facing slow server responses, long-running requests, large data transfers, or unpredictable network conditions. This ensures stable connections, enhancing application reliability and user experience. **Client Body**- Specifies the maximum allowable size of the client request body, is set to a default of 20MB. Increase when handling larger uploads to prevent request rejection due to size constraints, ensuring seamless data transmission. **HTTP Headers**- Components of an HTTP request or response, conveying additional information such as authentication, caching directives, or content type. Common headers include "Authorization," "Content-Type," and "Cache-Control." Users can include custom headers for specific application requirements, enhancing communication and functionality. **Cipher suites**- Sets of cryptographic algorithms used for securing network connections, including key exchange, encryption, and authentication. Activate advanced cipher suites to enhance security, particularly in high-risk environments or when strict encryption standards are mandated, ensuring robust protection against cyber threats.

**4. Rate Limiting** Within the Custom WAF Policies tab, users have the capability to implement rate limiting for traffic based on various parameters including IP address, country, and Request URI, among others. Additionally, users can apply rate limits based on combinations of these specified parameters to finely tune traffic management.

5. **False Positives** In the Built-in WAF policies tab, users can view the false positives. False positives can be manually incorporated via the Attack Analytics Tab. When a legitimate request is mistakenly classified as an attack, users can locate it within the Attack Analytics tab and designate it as an exception.

6\. **Consolidated Dashboard** **Unified View:** Gain a comprehensive overview of your security posture across all your domains within a selected cluster. This powerful feature eliminates the need to switch between individual domains, saving you valuable time and effort.

Within this section, the platform highlights anomalous requests directed towards the application. Advanced AI/ML technology to analyze and profile the application during a learning mode phase, subsequently formulating application-specific rules in the backend. This process assigns a threat score value to the application, with any request surpassing this threshold automatically blocked for a duration of 48 hours. **7. Slack Webhook** Once you have your Slack Webhook URL, you can paste the same here as shown in the image. This will allow Prophaze to send real-time alerts directly to your specified Slack channel.

# Account Creation To start your journey with Prophaze AppSec, first you have to register an user account with the company name and email id along with agreeing to our terms and conditions. The signup process is the beginning part of the journey with Prophaze AppSec. During sign-up, complete assistance from Prophaze is offered. \ **Go to** [**https://dash.prophaze.com/register/**](https://dash.prophaze.com/register/)

Fill the sign-up form with your company name, Official Mail id and Confirm a password. By agreeing with Prophaze terms and conditions, you can hit the button “Free Sign Up”. Now the registration has been completed. Now you will be redirected to a page as shown below:

To secure your domains, complete the set up wizard.
**For SaaS customers:** Please follow these[ ](/waf-onboarding/deployment-models/cloud)[**procedures.**](/waf-onboarding/deployment-models/cloud) **For On-Premise Customers:** Please follow these [**procedures**](/waf-onboarding/deployment-models/on-premise)**.** **For Kube-native Customers:** Please follow these [**procedures**](/waf-onboarding/deployment-models/kubernetes-deployment)**.** ## **Slack Webhook:** Webhooks are used for real time notifications, so your system can be updated right when an event takes place. Outgoing Webhooks was a quirky way to send your own server a Webhook when messages met a narrow set of criteria.

Enter the URL and click on Save button

# Deployment Models * Cloud deployment * On premise deployment * Kube-native # Cloud Our Cloud Server span around the globe which only required dns change for application onboarding. For cloud deployments Prophaze WAF supports the following cloud providers * Microsoft Azure * Google Cloud Provider * Amazon AWS * DigitalOcean ## SaaS Customer Onboarding Strategy SaaS onboarding can be done at any time when a user is new to the platform. This could happen most of the time with free trials. However, it needs a smaller onboarding process. **Signup process** Once you are done with the registration process, you will be redirected to a set up wizard page where you can secure your domain(s). Here you need a few pieces of information from the client’s end to complete the user registration. The steps are as follows: \ 1\. The current domain name without http/https ([www.xyz.com](http://www.xyz.com)).

2\. Current Hosting/Server IP Address (The IP address mentioned in the DNS manager. This IP may belong to a load balancer or a machine).

3\. Select the cluster which is nearest to your location from the drop down list, so that it can reduce the latency issue.

4\. Need to change the current DNS record from the customer end. For this, the customer needs to add a CNAME to their domain in the DNS manager (eg. GoDaddy, AWS route53), provided by Prophaze. DNS record has to be changed once the application is onboarded on the WAF.

5\. Select the protocol for traffic routing, recommended to opt for ‘Force HTTPS Redirection’ for enhanced security. Can enable advanced cipher suites for additional security measures.

6\. Now all the details have been given for the registration process. To initiate the process, click the create button in the bottom right.

\ Upon making the DNS change and fully routing traffic through Prophaze WAF, the SSL certificate will be generated automatically. If needed, customers can also import their certificates. \ **SSL Certificate** \ Within the Settings menu, specifically within the Certificate manager tab, users have the capability to upload their own certificates. These certificates may be in either PFX file format or separate main certificate and private key formats.

Finally, the on-boarding process is completed and all the traffic will be protected by Prophaze WAF before it hits the customer. The customer can now log in to the WAF dashboard with the credentials created during the Registration process and can analyze the traffic which comes into the onboarded website before hitting the actual website. That traffic would be filtered out with the help of existing rules and behavioral analysis – only the legitimate traffic will be allowed to the onboarded domain. Also, you can find the logs and its corresponding graphical representation in the dashboard home page. \ **URL for login:** [**https://dash.prophaze.com/**](https://dash.prophaze.com/login) # On-Premise ## **System Requirements** * Minimum 2 node cluster**:** one WAF node and one Management node * Prophaze WAF tested on the following operating systems in on premise deployments

Type	Version
Ubuntu	22.04, 24.04
RHEL	8.6

#### Management Node Hardware 1. 2 vcpu 2\. 8gb memory #### WAF Node Hardware 1\. 4 vcpu 2\. 16gb memory ***NOTE**: The ports 6443 of the management and the port 80 and 443 of the WAF node should be open and available. Machines should be present on same local network.Internet and ssh access are needed.* ## **Onboarding for On-Premises Customers** **ON-Premise WAF installation** Prophaze waf will be installed in the allocated VMS. (Our team will guide) \ **URL for login:** [**https://dash.prophaze.com/**](https://dash.prophaze.com/login) # Kubernetes Deployment ## Set Up Kubernetes Cluster *Note: Kube-native WAF is available only for enterprise customers. Please contact Prophaze customer support to upgrade the plan.* **Kube-native WAF installation** For Kubernetes native customers, we are providing Helm chart for setting up Prophaze ingress and after that traffic will be route through Prophaze ingress. **Step 1:** Prophaze will provide private git repo. git clone \ *Note:Private repo will be provided after contacting Prophaze support team.* Port 6443 which is the kube-apiserver port used for the dashboard to communicate with the kubernetes cluster for the ip: Prophaze IP should be allowed **Step 2:** Go to "Settings" page. Now, we need to connect your Kubernetes cluster to Prophaze.For that, click on the “**Kubernetes cluste**r” tab on the left side of the page .Copy the command and paste it in your kubernetes cluster.

**URL for login:** [**https://dash.prophaze.com/**](https://dash.prophaze.com/login) # Multi-Cloud Setup The Multi-Cloud Instances feature in Prophaze allows organizations to deploy and manage their WAF (Web Application Firewall) infrastructure seamlessly across multiple cloud environments. This ensures better scalability, high availability, and optimized performance by distributing workloads across geographically diverse cloud regions. To set up **Multi-Cloud Instances** in Prophaze, navigate to the **Settings page > Multi-Cloud Instances**.

#### Key Components of Multi-Cloud Instance Setup: 1. **New Cluster Name:** a. This is the identifier for your cluster within the Prophaze system. b. It helps differentiate between multiple clusters deployed across different cloud environments. c. Example: prophaze-eu-cluster1 2\. **Cluster Endpoint:** a. This is the URL or IP address that serves as the primary entry point for managing or interacting with the cluster. b. It ensures proper routing and communication between Prophaze and your cloud environment. 3\. **CNAME (Canonical Name):** a. CNAME is an alias used to map one domain name to another. b. It simplifies the process of routing traffic and ensures easier management of DNS records. 4. **A Record:** a. The A (Address) Record maps a domain name to an IP address. b. It ensures that traffic intended for a specific domain reaches the correct cluster endpoint. 5. **Service Account Token:** a. This authentication token acts as a key to validate and authorize the connection between Prophaze and your cloud environment. b. It ensures secure access and prevents unauthorized interactions. 6. **Select Geographic Location:** a. Choosing the Geographic Region (e.g., Europe-North) helps optimize latency and ensure compliance with regional data regulations. b. Deploying clusters closer to the target user base improves response times and overall application performance.
# Dashboard This document contains user manual on how the dashboard can be used to analyse various attack vectors.

Event Dashboard contains views related to * Number of Attacks Blocked * Total traffic request per day * Number of rules triggered * Attack Percentage * Total Bandwidth size * Geo Attack Distribution * Attack Types and Density of each attacks * Quick traffic Analyze Graph for both Attacks and the entire traffic. All graphs are interactive, allowing users to click on them for deeper analysis, leading to their respective modules. There is a WAF on-off functionality in the navigation bar. By enabling the button, WAF will be in active mode and website is protected from bad actors. Each of the Dashboard module is covered in the next section.
# Traffic Analysis Detailed Log Analyzing with various filter options through Traffic 360 page. The Traffic Analyzer provides immediate visibility into recent server requests. It offers various filters to conduct targeted analysis based on specific parameters, facilitating focused investigation and insights.

Traffic analyzer gives a quick look on * Source IP * Timestamp * Targeted URI and Requested Args by the attacker and legitimate user. * Status code By clicking "Show Details," users can access the User Agent, request country, and destination IP to which incoming requests were forwarded. Additionally, users can blacklist or whitelist IPs, block countries, or whitelist requested URLs, providing versatile control over access management.

The logs displayed are unique to each IP, consolidating all requests from a single IP into a single log entry. Clicking "Explore" opens a new tab, providing a detailed view of all requests associated with the specific IP address.

# API Discovery Our advanced API Discovery Module ensures continuous discovery and monitoring of APIs, enabling real-time identification and tracking of all types, including edge APIs. ## API Discovery Module Overview #### This provides organizations with comprehensive visibility into their API ecosystem, allowing for detailed analytics and enhanced security measures. ### **1. Continuous API Discovery:** * The API Discovery Module constantly monitors your application traffic, discovering new APIs and tracking various API types, including edge APIs. * Continuous discovery ensures that any new or previously unknown APIs are identified in real time, reducing the risk of shadow APIs going unnoticed. ### 2. Dashboard and Analytics: * The dashboard provides a centralized view of all API endpoints and offers detailed analytics to monitor API performance and security.

* The dashboard visualizes data, making it easier to identify trends, analyze traffic, and assess security issues across different API endpoints. This aids in proactive security management. ### 3. Detailed Examination of API Actions: * You get detailed insights into the actions performed by APIs, such as headers, query parameters, and body parameters.

* This granular level of visibility helps security teams understand how APIs are being used and pinpoint potential vulnerabilities based on the data being transmitted. ### 4. Analytics: #### a.)Endpoint Information: Shows the method used (e.g., GET, POST) for each endpoint, the number of attacks detected, and traffic data. This helps monitor which endpoints are most vulnerable or most accessed. **b.)Attack Analytics:** Tracks attempted and successful attacks on APIs, helping to refine security policies.

**c.)Traffic Analytics:** Monitors traffic to identify usage patterns or anomalies, which could indicate an attack or unusual behavior. **d.)Top IP Addresses/Countries:** Identifies the origin of traffic, helping you recognize potential threats from specific IPs or geographical locations. **e.)Status Codes:** Shows HTTP response codes, which help to understand if endpoints are functioning correctly or are facing issues (e.g., too many 404 errors).
### **Two Methods for Activation:** * Onboarding Configuration: API Security can be set up during the initial onboarding process to ensure security is embedded from the start. * Application Settings: API security can also be activated or modified later through the application settings, providing flexibility for adjustments as needed.
The API Discovery offers comprehensive tools to monitor, analyze, and secure your APIs. With continuous discovery, detailed analytics, and the ability to customize rules, it ensures that your APIs are protected against evolving threats, all while providing deep visibility into API performance and security.
# Attack Analytics Detailed Attack Log Analyzing with various filter options The Attack Analyzer provides immediate insight into recent attacks, featuring diverse filters for targeted analysis based on specific parameters, streamlining investigative efforts, and fostering deeper understanding.

Displayed logs are tailored to individual IP addresses, consolidating all attacks from one IP into a singular log entry. Clicking "Explore" launches a new tab, presenting an overview of all attacks associated with the designated IP. This tab offers a concise overview of: * Source IP * Timestamp * Attack Type * Status Code * Action Taken * Severity * Request URI

For a comprehensive perspective on attacks, accessing the "Show Details" tab provides users with insights into request headers, request body, response headers, and rules activated to counter the attacks. Additionally, users can whitelist URLs, block source countries, or mark incidents as false positives.

# DDOS Attacks Detailed DDOS Attack Log Analyzing with various filter options. Similar to Attack Analyzer, DDOS Attack Analyzer provides immediate insight into recent DDOS attacks, featuring diverse filters for targeted analysis based on specific parameters, streamlining investigative efforts, and fostering deeper understanding. By clicking "View" users can access the User Agent, request country, and Reference URL. Additionally, users can blacklist or whitelist IPs, block countries, or whitelist requested URLs, providing versatile control over access management.

Another important feature is Traffic graph as shown below.

Comparative Traffic Graph: The DDoS attacks page features a visual graph. This graph compares regular website traffic with DDoS traffic over time. This visualization allows you to easily identify potential DDoS attacks by spotting spikes in DDoS traffic that deviate from your normal traffic patterns. Traffic Request Counts: In addition to the graph, Prophaze provides a comparison of the total count for both regular traffic requests and DDoS traffic requests. This numerical data complements the visual representation in the graph and offers a more precise understanding of the attack volume.
# Rules Page Prophaze offers more granular control over your web application security with WAF Policies page. ## Built-in Rules

**Enable or Disable:** You now have the flexibility to enable or disable individual WAF policies based on your specific security needs. This allows for a more customized approach to web application security. **Focus on Your Priorities:** If you're concerned about a particular type of attack (e.g., SQL injection), you can enable the corresponding WAF policy while potentially disabling others that might focus on less relevant threats. This helps in reducing the false positives, you can find the false positives section in the same page given as Exceptions. ## Custom Rules In addition to the preconfigured OWASP Top 10 and SANS 25 rules within the backend, users have the flexibility to create their own custom rules. The WAF offers approximately 12 parameters—including IP, country, ASN, Useragent, and cookie—on which rules can be constructed for whitelisting, blacklisting, rate-limiting, or implementing temporary or permanent redirects to other links.

\ Users can also combine multiple parameters to formulate a single rule. Simply click on "Add Rule" to incorporate a new parameter. Once configured, finalize by clicking "ADD" at the bottom. Rules become functional immediately upon configuration and take effect in real-time.

# Bot Mitigation Advanced Mitigation Measures **Bot Protection** is disabled by default and can be enabled when the application is under a bot attack or shows signs of a potential DDoS threat. Prophaze provides multiple bot protection strategies to suit different scenarios: * **Captcha-less Challenge**: The Captcha-less Challenge uses advanced JavaScript techniques to analyze user interactions, such as mouse movements, browsing behavior, and device fingerprints, to distinguish humans from bots with high accuracy. It delivers strong protection while maintaining a smooth user experience, making it ideal for e-commerce, content-heavy platforms, and other scenarios where seamless access is a priority. * **Captcha Challenge**: The Captcha Challenge strengthens access control by requiring users to complete a simple verification step, ensuring only genuine users gain entry. By adding this extra layer of assurance, it effectively prevents automated bots from exploiting sensitive processes. This approach is particularly valuable for login portals, financial transactions, and applications that demand strict authentication and data protection. * **PhantomJS Challenge**: The PhantomJS Challenge focuses on detecting automated traffic that attempts to mimic legitimate users through headless or script-driven browsers. Using advanced behavioral and environment analysis, it silently blocks malicious activity in the background without affecting the user journey. This ensures genuine users enjoy uninterrupted access, while automated attacks such as scraping, credential abuse, and exploitation attempts are neutralized effectively. * **Whitelist Option**: Prophaze’s bot mitigation tools include a customizable whitelist feature, allowing administrators to define trusted traffic sources or user agents. This ensures that legitimate users are not mistakenly blocked while still enforcing protection against unauthorized automated access.

# Anomaly Detection Intelligent detection using AI/ML Within this section, the platform highlights anomalous requests directed towards the application. Prophaze leverages AI/ML technology to analyze and profile the application during a learning mode phase, subsequently formulating application-specific rules in the backend. This process assigns a threat score value to the application, with any request surpassing this threshold automatically blocked for a duration of 48 hours.

# Load Balancer Load Balancer in Prophaze: Ensuring High Availability and Efficient Traffic Distribution The Load Balancer in Prophaze WAF is a critical component designed to ensure seamless traffic distribution, high availability, and optimized performance for web applications and APIs. It efficiently manages incoming network traffic, balances the load across multiple endpoints, and ensures that applications remain responsive even during high traffic volumes or partial outages. #### Key Functions of Prophaze Load Balancer: 1. **Traffic Distribution:** * The load balancer evenly distributes incoming application traffic across multiple backend servers (endpoints) to prevent any single server from being overwhelmed. * Supports different routing mechanisms, including round-robin routing, weighted routing, and IP-based routing. 2. **High Availability:** * Ensures continuous availability of applications by automatically rerouting traffic to healthy servers if one endpoint becomes unresponsive. * Helps minimize downtime during maintenance or unexpected server failures. 3. **Sticky Sessions (Session Persistence):** * With Sticky Sessions enabled, the load balancer ensures that all requests from a specific client are routed to the same server for the duration of the session. * This is essential for applications requiring consistent session management, such as e-commerce platforms and financial systems. 4. **Weighted Routing:** * When Weighted Routing is enabled, the load balancer can distribute traffic unevenly across endpoints based on assigned weights. * Each endpoint is given a weight (1-10), and servers with higher weights receive more traffic. * Useful for scenarios where some servers have more capacity or better performance capabilities than others. 5. **Endpoint Management:** * Endpoints are defined using IP addresses and port numbers, ensuring precise routing of traffic. * The configuration supports dynamic addition or removal of endpoints without disrupting existing operations.

#### Configuration Parameters in Prophaze Load Balancer: Once you navigate to the Settings page, select Load Balancer, and enter the required details as given below: 1. **Load Balancer Name:** * Must contain only lowercase letters, numbers, dashes (-), and underscores (\_). * Serves as a unique identifier for the load balancer configuration. 2. **Sticky Session:** * Enable or disable session persistence based on application requirements. 3. **Weighted Routing:** * Enable weighted traffic distribution for fine-tuned control over endpoint utilization. 4. **Endpoints:** * IP Address: A valid IPv4 or IPv6 address of the backend server. * Port: A valid port number where the application is listening (e.g., 80 for HTTP or 443 for HTTPS). * Weight: A numeric value between 1 and 10, representing traffic priority for each endpoint. 5. **Add Endpoint:** * Easily add or remove backend servers without causing disruptions to active connections # Slack Webhook Prophaze Slack Webhook Integration Explained The **Slack Webhook Integration** feature in Prophaze enables real-time threat notifications to be delivered directly to your Slack workspace. This integration enhances incident response by ensuring that your security team is instantly alerted about critical threats, vulnerabilities, and security incidents. #### Key Configuration Details: 1. **Slack Webhook URL:** * This is the unique URL provided by your Slack workspace when you create an Incoming Webhook integration. * It serves as the communication bridge between Prophaze WAF and your Slack workspace. * The URL ensures that security alerts and threat notifications are pushed directly to your designated Slack channel. 2. **Live Threat Notifications:** * With the Slack Webhook configured, you’ll receive real-time alerts for security events such as: a. SQL Injection attempts b. DDoS Attacks c. Unauthorized access attempts d. Malware and Bot activity

#### Steps to Configure Slack Webhook Integration: 1. Navigate to Settings in the Prophaze Dashboard: * Go to Settings → Slack Webhook. 2. Enter the Webhook URL: * Paste the Slack Webhook URL in the designated field. 3. Save Configuration: * Click Save to activate the integration. 4. Test the Integration: * Prophaze will send a test notification to ensure successful integration. # Activity Log Prophaze Activity Log Explained The **Activity Log** in the Prophaze Dashboard serves as a centralized record-keeping feature that tracks all administrative and configuration-related activities within the platform. It provides transparency, accountability, and real-time visibility into changes and updates made across your WAF-protected applications and domains.

#### Key Components of Activity Log: 1. **IP Address:** * Displays the **originating IP address** from which the activity was performed. * Example: **152.58.30.110, 122.164.12.155** 2. **Timestamp (UTC):** * Records the **exact date and time** when the activity occurred in **Coordinated Universal Time (UTC).** * Example: **12/30/2024 06:48 am UTC** 3. **Domain/Application Affected:** * Specifies the **domain or application** where the activity took place. * Example: **prophaze.com, testdvwa.kubewaf.com** 4. **Activity Description:** * Provides a **clear description** of the action performed. * Examples: * **Turned on active mode** * **Turned off active mode** * **Updated a website** * **Enabled/Disabled bot protection** * **Selected Captchaless Challenge** # Reporting Reporting engine to generate weekly reports. Users have the option to download weekly reports from the Reports tab. Click "Generate Attack Report", and after 3 to 4 minutes, the report will be ready for download. Access the "Report" tab to retrieve the generated report.

# Attack Types Using Attack Type Dashboard module we will get a quick overview on what is the prominent attack types which are targeted to the host server

# Incidents Total number of incidents in a requested time frame can be viewed in this dashboard module as shown below

# AppSec Toggle Mode Prophaze makes managing your Web Application Firewall made easier with the introduction of an "active mode toggle" on the settings page for your active website.

Active Website Settings Toggle: This toggle is located directly on the settings page for your currently active website. It allows you to quickly adjust the WAF mode for that specific website without navigating elsewhere. # SSL Certificate Step-by-Step Guide: Updating Your SSL Certificate on the Prophaze Dashboard To update the SSL certificate on the Prophaze dashboard, follow these detailed steps to ensure your domain maintains secure communications: 1. Log in to the Prophaze Dashboard\ Begin by logging in to your Prophaze account, where you’ll be able to access the settings for the specific domain requiring the SSL update. 2. Select the Domain\ Once on the dashboard, find and select the domain for which you wish to update the SSL certificate. Each domain managed by Prophaze will have its own settings, so make sure to select the correct one. 3. Navigate to the Settings Tab\ Scroll down to the Certificate Manager option. This section is dedicated to managing SSL certificates, allowing you to view current certificates and upload new ones. 4. Upload Your SSL Certificate * Here, you’ll be prompted to upload the new SSL certificate. Prophaze supports both .pfx and .crt formats. * If using a .crt format, you may also need to provide the .key file, which contains the private key associated with your SSL certificate. * Once the certificates are uploaded click on submit and you will be notified that the SSL certificate is successfully uploaded.

After these steps, the SSL certificate update will be complete, and Prophaze will automatically apply it to your domain, securing communications and ensuring that your site meets up-to-date security standards.
# Encoding Types The following encoding types are supported: * Application/x-www-form-urlencoded encoding * Multipart/form-data encoding * V0 cookies * V1 cookies * Chunked encoding in requests * Chunked encoding in responses * Request compression * Response compression # Protocol Validation Prophaze WAF has the following protocol validations in effect * Method Restriction * Protocol and Protocol version Restriction * RFC Validation * URL Encoding Validation * Validation of Non-Standard Encoding * Cookie Enforcement #### Additional Restrictions * Element content and length * Element byte range * Character set validations Restrictions can be applied at * Application Level * Object Level * Parameter Level #### Additional Protocol Limits Supported by Prophaze WAF * Request method length * Request line length * Request URI length * Header name and value * Request body length * Cookie value , name and number * Parameter name , value and length # HTTP Protocol Violation Prophaze WAF can detect and block HTTP Protocol violation detection in the following ways * Blocking GET/HEAD Request with a body * POST Request without Content-Length Header * Identity should be used in Accept-Encoding not in Content-Encoding * Denies non HTTP/1.1 Requests HTTP/1.1 request with pragma:no-cache header with out corresponding Cache-Control header * Request with abnormal or excessive byte range in one request Request with Broken connection header # Protocol Anomalies Prophaze WAF can detect request with the following protocol anomalies * Request without Valid Host Header * Request without Valid Accept Header * Request header with null value * Invalid User-Agent header * User-Agent without value * Request with Content contains no Content-Type header * Host Header with IP Address # Bot Detection Prophaze WAF's advanced bot detection module can identify bots based on premium daily updated bot IP Address databases , and behavioural patterns And also it make sure that the legitimate bots like Google Bot , Yahoo slurp etc are not blocked in any ways # Injection Prevention Prophaze WAF can prevent the following Injection attacks * OS Command Injection - Exploiting arbitrary commands in the operating system to fingerprint Infrastructure details , and to establish a trust between host operating Systems . This happens when application passes unsafe data which Includes Forms , Cookies , URL Arguments etc * Coldfusion Injection – Prevents database injection in Coldfusion apps * LDAP Injection - Stops exploits which attacks LDAP Protocol * SSI Injection – Prevents attacks which manipulates server side Includes to execute remote code injections * UPDF/XSS Injection – Prevents XSS attacks on applications with pdf Files * Email Injection – Prevents Email Injection where attacker utilizes Carriage return to inject extra email headers to the contact form * Blocks system command access * Blocks Directory Traversal attacks # HTTP Request Smuggling Prophaze WAF Prevents HTTP request smuggling , its a scenario where a cache just before the application fails to validate incoming requests .This Enables cache to trust malformed headers send by hackers which Enables cache poisoning. # HTTP Response Splitting Prophaze WAF Blocks Carriage Return (CR) and Line Feed (LF) requests into the Applications which allows attackers to use HTTP Response Splitting # XSS Prevention Prophaze WAF can prevent advanced XSS attacks in the following ways * Blocks injection of client side scripts into browsers by attackers which allows them to steal session and cookie data * Uses Open source lib injection library along with regular expressions * HTML tag finder * Style/Script Tag prevention * JS Fragment prevention (URI) * CSS Fragment Prevention * Blocks XSS fingerprints * Event Handler Block * Attribute Vector Prevention * Noscript html injection * IE filters * Malformed XSS Filter * UTF-7 encoding XSS Prevention (IE) * Disallowed HTML attributes # LFI and RFI Prophaze WAF can prevent local and remote file execution exploits by the following ways * Block RFI attack on application which allows attackers to include a file Exploiting dynamic file inclusion feature * Blocks URL in request argument * Blocks PHP include() function * Blocks requests ends with question mark * Path traversal and Restricted file access # Session Fixation Prophaze WAF can prevent session fixation attacks by the following ways * Prevents attackers to hijack a valid session * Blocks setting cookie values with in html * Blocks session parameter with off-domain referrer * sessid parameter with no referrer # SQL Injection Prevention Prophaze WAF deployed wide range of methods into its core algorithm to block generic and advanced SQL injection attacks where not-sanitised user inputs is used to inject SQL commands which can disclose system Information and data leakage . The most common sql injection methods blocked are . * SQL comment sequence * SQL hex sequence * SQL String Termination * SQL Operators Blocking * Blocks SQL Tautologies * Blocks Common Database Names * Blind SQL injection Blocking * Injection Character anomaly blocking * Injection Payload Blocking * MSSQL specific signatures * SQL Integer overflow * SQL sleep command exploit * Prevents conditional SQL injection * MySQL character switch injection * SQL Authentication Bypass * pg\_sleep injection * Chained SQL Injection * Stored procedure Injection * UDF Injection using data structure manipulation * Concatenated SQL Injection # Layer 7 Dos Attack Prevention Prophaze WAF got Layer 7 (Application Layer) DDoS prevention . It can detect anomalies from a request , if the request is targeted towards a dynamic or static resource and the hits on the resource exceeds more than what is expected in a given time period . The request is blocked at the ingress level. # PHP Application Protection As most of the application in web consists of php as the server side language . Prophaze WAF got module to secure the app from attacks targeting the php apps . Some of the protection methods built into the core are * PHP open and close tag detection * Script file upload prevention * Blocking configuration directives * Variables and IO stream blocking * Blocking high risk PHP function calls * Disabling PHP serialisation object * Variable function call detection # Normalization Prophaze WAF supports following normalisation techniques * URL-decoding * Null byte string termination * Self-referencing paths * Path back-references * Excessive use of white space * Comment removal * Conversion of (Windows-supported) backslash characters into forward slash characters. * Conversion of IIS-specific Unicode encoding (%uXXYY) * Decode HTML entities * Escaped characters # Negative Security Model Prophaze WAF supports the following Negative security model * Signature-based - Detect attacks by performing a string or a regular expression match against traffic. * Rule-based - Rules are similar to signatures but allow for a more complex logic to be formed (e.g. logical AND, logical OR). They also allow for specific parts of each transaction to be targeted in a rule. # Signature and Rule Database Prophaze WAF comes with daily updated rules and signature database . Have access to dozens of premium signature database , and supported by International Security Researchers. # Onboarding Process

What are the prerequisites for onboarding?

To start the POC, please provide us with the below details- 1. The Fully Qualified Domain Name (FQDN) to be onboarded. (The FQDN must have at least 6000 to 7000 hits in 4 days.) 2. The endpoint IP address associated with the FQDN. 3. Information on any custom ports the application uses, aside from ports 80 and 443. 4. The location or region where the FQDN is hosted. 5. The SSL Certificate- Either in .crt and .key format or PFX file and its password 6. DNS access for the FQDN

What domain name should I enter?

Enter the primary domain name you want to secure with Prophaze WAF. This could be your main website (e.g., example.com) or a subdomain like your API endpoint (e.g., api.example.com). (FQDN)

What is an endpoint?

An endpoint is a specific URL or Loadbalancer IP or Public IP that points to your domain. (example: 134.124.176.148) should not be a private IP or 10 series,,,private ip series.

What geographic location should I choose?

This information is used for regional security considerations, regulatory compliance purposes and latency purpose. Choose the location where your application servers are physically located. We can add other regions as well. ![](/files/PLSMUX2WZ4IGdhRPINEb)

What is a CNAME record and how do I add it?

A CNAME record aliases your domain name to another domain name. Prophaze will provide specific instructions on adding the CNAME record to your domain name system (DNS) management console. This step routes traffic through Prophaze WAF for security inspection. You can also do this through A record changes using the IP provided by Prophaze for the root domain. (It may vary from region to region) n subdomain CNAME needs to be changed.

What alternative DNS record types can be used besides CNAME?

In some cases, an A record pointing to Prophaze WAF's IP address is an option instead of a CNAME record. This depends on your specific domain configuration.

What happens to my existing DNS records when I add the Prophaze CNAME record?

Adding the Prophaze CNAME record typically doesn't affect your existing DNS records. It simply creates an alias for your domain name that points to Prophaze WAF for security inspection before reaching your application server.

Where can I find DNS related information?

You can go on to 1. Settings page. 2\. Configure applications. 3\. Click on the edit (pencil) button. 4\. DNS setting. Here you will get the information like CNAME and A-record.

What happens to my existing MX records (for email) when adding a CNAME record for Prophaze WAF?

Prophaze WAF integration won't affect your MX records as they point to separate servers for email delivery. You can typically manage MX records and CNAME records independently within your DNS management console.

Do I need a valid SSL certificate for Full HTTPS?

Yes, a valid SSL/TLS certificate is crucial for secure communication with Prophaze WAF. You'll need to have an active SSL certificate installed on your web server for HTTPS functionality. Prophaze can also get an SSL certificate through Let’s Encrypt if you don't have an SSL certificate.

What is Full HTTPS?

Full HTTPS ensures all communication between your application and users is encrypted using HTTPS protocol. This is crucial for protecting sensitive data transmission.

What happens to my website traffic during the CNAME record change?

There might be a brief service interruption while your DNS propagates the CNAME record change.

# Dashboard Terminology **Bandwidth Consumption:**

What do the total bandwidth consumption and upload bandwidth mean?

* This indicates the total amount of data transferred through the Prophaze appliance during the reporting period. (incoming and outgoing). * Upload bandwidth represents the data uploaded from your network to the internet.

How does Prophaze handle large file uploads that could consume significant bandwidth?

Prophaze has features to manage large file uploads, such as: * Throttling upload speeds to prevent overwhelming bandwidth. * Setting size limits for uploads to prevent abuse. * Integrating with Cloud storage solutions for efficient handling of large files.

**Geo Attack Distribution:**

What countries are the attacks originating from?

The map shows the geographical distribution of IP addresses associated with the blocked/detected attacks. This can help identify potential sources of threats. ![](/files/wGilZGERnKWOYeSbE7Na)

**Attack Types:**

What do A03:2021-Injection and A04:2021-Insecure Design mean? Naming conventions

These codes represent specific attack categories identified by Prophaze. * A03:2021-Injection indicates attempts to inject malicious code into your system. * A04:2021-Insecure Design points to vulnerabilities in website or application design that attackers try to exploit.

**Top 10 Attack IP Addresses:**

What should I do about the IP addresses listed here?

If in active mode it will automatically be blocked and if in learning mode it will only be detected (Prophaze will do these parts.) * You can consider blocking these specific IPs at your network firewall if the attacks are persistent and originate from the same sources.

**Top 10 Attack Originating Countries:**

Does this mean all traffic from these countries is malicious?

* No, it only indicates that attacks originated from IP addresses located in those countries. Legitimate traffic can also come from these regions. Which won't be blocked. * We can block the traffic coming from a particular country.

**Top 10 User IP addresses:**

What do these IP addresses represent?

This list shows the top 10 IP addresses that generated the most traffic during the reporting period.

**Most Used HTTP Methods:**

What do the different HTTP methods (GET, POST, HEAD, OPTIONS) represent?

These are standard methods used in HTTP communication between web browsers and servers. * GET is used to retrieve information from a server. * POST is used to send data to a server.

**IP Address Information:**

What information is provided for each attack attempt?

The table shows: * Date and Time of the attack attempt * IP Address of the attacker * Country associated with the IP address * Two options: "Permanently Block IP address" and "Allow IP address" * "Explore" button leads to more details about the specific attack.

**Taking Action:**

What does "Permanently Block IP address" do?

This option instructs the security solution to block all future traffic attempts from that specific IP address.

What does "Allow IP address" do?

Choosing this option would allow traffic from that specific IP address despite the potential attack attempt.

How are attacks identified and grouped by IP address?

The security solution analyzes traffic patterns and compares them against known attack signatures or threat intelligence to identify suspicious activity.

What factors should I consider before blocking an IP address?

* False positives: Security systems can sometimes misidentify legitimate traffic as attacks. Investigate before blocking to avoid impacting authorized users. * IP reputation: Check if the IP is known to be malicious using online tools or threat intelligence feeds. Impact on legitimate users: Blocking a shared IP address might affect other users behind that IP. Consider alternative mitigation strategies if necessary.

Are there other ways to manage attacks besides blocking IP addresses?

* Rate limiting: Restrict the number of requests an IP address can send within a specific timeframe. * Challenge-response mechanisms: Implement CAPTCHAs or other challenges to differentiate between bots and human users. * Security rules customization: Create custom rules based on specific threat intelligence to target attack patterns.

What is SQL injection?

SQL injection is a cyberattack technique where malicious code is injected into website forms or database queries. This code can then be used to steal sensitive data, modify information, or disrupt website functionality.

Do we get the information about what was the targeted URI (Uniform Resource Identifier)?

Yes, we get information like the below given example: * /wp-content/plugins/about.php - This suggests the attacker might have targeted a specific plugin on a WordPress website.

Can we know the severity of the attack?

Yes, depending upon the attacks they are categorized as high and low. * High - This indicates a potentially serious attack that could have compromised the website or user data.

**Request Details:**

What information is included in the request headers?

This section shows details about the attacker's browser, encoding preferences, and connection type.

Do we get to know what type of attack it was?

Yes, we get all the information about different kinds of attacks like: * An SQL injection attempt. This means the attacker tried to inject malicious code into a web page to potentially steal data or gain unauthorized access to the system

How did Prophaze detect the attack?

Prophaze identified specific characters or patterns in the request body that are commonly used in SQL injection attempts (e.g., "print\_r"). Other similar methods are also used depending on the attack patterns.

What did the attacker try to achieve?

SQL injection attempts can be used for various malicious purposes, such as: * Stealing sensitive information from the database (usernames, passwords). * Modifying data stored in the database. * Taking control of the database server.

# Attack Section **Taking Action:**

What does "Permanently Block IP address" do?

This option instructs the security solution to block all future traffic attempts from that specific IP address.

What does "Allow IP address" do?

Choosing this option would allow traffic from that specific IP address despite the potential attack attempt.

How are attacks identified and grouped by IP address?

The security solution analyzes traffic patterns and compares them against known attack signatures or threat intelligence to identify suspicious activity.

What factors should I consider before blocking an IP address?

Are there other ways to manage attacks besides blocking IP addresses?

What is SQL injection?

Do we get the information about what was the targeted URI (Uniform Resource Identifier)?

Yes, we get information like the below given example: * /wp-content/plugins/about.php - This suggests the attacker might have targeted a specific plugin on a WordPress website.

Can we know the severity of the attack?

Yes, depending upon the attacks they are categorized as high and low. * High - This indicates a potentially serious attack that could have compromised the website or user data.

**Request Details:**

What information is included in the request headers?

This section shows details about the attacker's browser, encoding preferences, and connection type.

Do we get to know what type of attack it was?

Yes, we get all the information about different kinds of attack like: * An SQL injection attempt. This means the attacker tried to inject malicious code into a web page to potentially steal data or gain unauthorized access to the system

How did Prophaze detect the attack?

What did the attacker try to achieve?

What does the Request Body section show?

It reveals a series of parameter names ("google", "cdshell", etc.) containing the same malicious code (print\_r(1357908642);). This code likely attempts to interact with the website's database in an unauthorized way.

What can be learned from the Request Headers?

These headers reveal information about the attacker's browser (e.g., Mozilla/4.0) and potentially spoofed information (e.g., User-agent indicating an outdated browser).

What can be learned from the Request Body?

This section contains suspicious code (print\_r(1357908642);) repeatedly used with different keys, likely an attempt to exploit vulnerabilities in the targeted plugin.

**Rules Triggered:**

What kind of rules are triggered by attacks?

Example of triggered rules: 1.High: * SQL Injection character found (A04:2021-Insecure Design) * SQL String Termination (Body) (A04:2021-Insecure Design) 2.Low: * Suspicious traffic - Header (Alert)

What actions can be taken to prevent similar attacks?

* Keep website software (including plugins) updated to address known vulnerabilities. * Use strong input validation techniques to sanitize user input before processing it in database queries. * Consider implementing additional security measures like Web Application Firewalls (WAF) for advanced protection.

## **DDOS** **Understanding the Chart:**

What does the X-axis (horizontal) represent?

The X-axis represents time, according to the dates selected. ![](/files/01G7TSPFk4ZdkLTurviI)

What does the Y-axis (vertical) represent?

The Y-axis represents the number of requests received. The scale goes from 0 to any number of requests received. ![](/files/gU3pQS9iXMSwbAC7t0WB)

What do the values on the chart represent?

Each data point on the line represents the total number of requests received during that specific time interval.

**Understanding the DDoS Attacks Table:**

What information is provided in the table?

* Time: Date and time the potential DDoS attack was detected. * IP Address: IP address of the attacker. Be cautious, spoofed IP addresses are common in DDoS attacks. * Referrer URL: The website that is potentially linked to the attack (might be empty if not applicable). * Status: The HTTP status code returned by the server (likely 503 - Service Unavailable during a DDoS attack). * Request URI: The specific resource or page requested by the attacker. * Action: Options to Explore details, Block the IP address, Allow the IP address, Block the entire country (caution advised), or Allow the specific requested URL.

What can I do with the information in the DDoS Attacks table?

* Explore: Investigate the details of the attack attempt to understand the attack method. * Blocking Actions: Use with caution! Blocking legitimate traffic can disrupt user access. Analyze the IP address and attack details before blocking. * Allow Actions: If you trust the source (unlikely for DDoS attacks), you can allow specific IPs or URLs.

How are DDoS attacks identified?

Prophaze analyze traffic patterns for unusual activity, such as sudden surges in traffic volume or a large number of requests originating from a multiple source. Prophaze might employ various techniques like: * Traffic volume analysis: Identifying sudden spikes in traffic that deviate significantly from baseline patterns. * Rate limiting analysis: Flagging IP addresses sending an unusually high number of requests within a short period. * Packet inspection: Analyzing network packets for characteristics associated with DDoS attacks (e.g., spoofed IP addresses, SYN floods). * Behavioral analysis: Monitoring traffic patterns for suspicious behavior like abnormal request types or geographical distribution.)

**DDoS Attack Types:**

Are there any indicators in the provided data that suggest specific attack types?

Looking at the targeted resources (Request URI) might offer clues. For example, attacks targeting "/.well-known/acme-challenge/" could be part of a credential stuffing attack utilizing Let's Encrypt certificates. Chng the example.

What are some common DDoS attack mitigation techniques?

* Rate limiting: Restricting the number of requests an IP address can send within a specific timeframe. * IP filtering: Blocking traffic from known malicious IP addresses. * Challenge-response mechanisms: Implementing CAPTCHAs to differentiate between bots and human users.

What are some advanced DDoS mitigation techniques that could be employed?

* Challenge-response mechanisms: Implementing CAPTCHAs or similar challenges at the network level to filter out automated bot traffic. * Geo-fencing: Restricting access to your website from specific geographical regions known for DDoS attacks (use with caution to avoid impacting legitimate users).

**DDoS Attack Detection:**

What specific methods does the security solution use to identify DDoS attacks?

* Traffic Anomaly Detection: Does it analyze traffic patterns to identify deviations from baseline behavior (e.g., sudden spikes in traffic volume, unusual request patterns)? * Signature-based Detection: Does it compare attack traffic to known DDoS attack signatures for identification? * Geolocation Analysis: Does it consider the geographical distribution of traffic to identify suspicious activity (e.g., a large volume of traffic originating from a single region)?

How can I prevent DDoS attacks?

Mitigating DDoS attacks completely might be difficult, but some practices can help: * Implement best practices for website security and traffic filtering.

# Rule Set **Rules:**

How are the rules categorised?

The rules are grouped based on the type of vulnerability or attack they target. These categories correspond to the "OWASP Top 10" web application security risks, a well-known industry standard.

What do the rule names (A01:2021-Broken Access Control, etc.) mean?

These names follow a common format used for referencing security vulnerabilities. They likely refer to the "Common Vulnerabilities and Exposures" (CVE) classification system. * The first part (A01, A02, etc.) indicates a specific vulnerability category. * The year (2021) represents the year the vulnerability was first identified. * The description provides details about the type of vulnerability the rule targets

What kind of attacks do these rules protect against?

Here's a breakdown of some rule categories and examples of attacks they might target: * A01:2021-Broken Access Control: Attacks that exploit weaknesses in how applications control access to resources (e.g., unauthorized access attempts). * A02:2021-Cryptographic Failures: Attacks that exploit weaknesses in encryption algorithms or implementations. * A03:2021-Injection: Attacks that inject malicious code into website inputs (e.g., SQL injection, XSS). * A04:2021-Insecure Design: Rules that target vulnerabilities arising from flawed application design practices. * A05:2021-Security Misconfiguration: Attacks that exploit improper security settings or configurations on the web server. * A06:2021-Vulnerable and Outdated Components: Rules that detect suspicious requests associated with known vulnerabilities in outdated software components. * A07:2021-Identification and Authentication Failures: Attacks that exploit weaknesses in user authentication mechanisms (e.g., brute-force attacks, session hijacking). * A08:2021-Software and Data Integrity Failures: Rules that target vulnerabilities allowing attackers to modify or manipulate software or data. * A09:2021-Security Logging and Monitoring Failures: Attacks that attempt to disable or bypass security logging mechanisms. * A10:2021-Server-Side Request Forgery: Attacks that exploit vulnerabilities allowing attackers to manipulate the server into performing unauthorized actions.

Are there additional rule categories not shown here?

Yes, there are more WAF rule categories beyond what's displayed based on AI/ML application profiling.

How do rules handle complex attacks that combine multiple techniques?

WAF rules can be layered to address different aspects of an attack. For instance, a rule might block specific SQL injection characters, while another rule might look for suspicious patterns in the request body.

Can custom WAF rules be created to address specific vulnerabilities?

Yes, Prophaze WAF allows creating custom rules based on regular expressions or other patterns. This can be helpful for targeting vulnerabilities unique to your website application.

**Exceptions:**

What does the "Exceptions" section show?

This section lists specific paths or resources within the website that are excluded from certain WAF rule checks. This allows legitimate functionality while maintaining security.

How can I determine which WAF rules to enable or disable?

Enabling all rules offers maximum protection but might lead to false positives (blocking legitimate traffic). Disabling rules increases risk but allows specific functionality.

**Adding a New Rule:**

What options are available to define the rule condition?

You can select various attributes to define the matching criteria for your rule. These include: * IP Address: Block requests originating from specific IP addresses. * Country: Block requests originating from specific countries. * ASN (Autonomous System Number): Block requests from a specific network provider. * User Agent: Block requests from specific browser types or suspicious user agents. * Cookie: Block requests containing specific cookies (might be useful for advanced scenarios). * Header: Block requests containing specific HTTP headers or header values. * Request URI: Block requests targeting specific URLs or URL patterns. * HTTP Method: Block requests using specific HTTP methods (e.g., POST, GET). * Referrer: Block requests coming from specific referring websites. * Content Type: Block requests with specific content types (e.g., script files). * Content Length: Block requests with content length exceeding a certain limit. * URL Length: Block requests with URLs exceeding a certain length (might be useful for blocking certain attack patterns).

Can I combine multiple conditions in a single rule?

The interface offers an "AND" option, which suggests you can combine multiple conditions using logical AND. This allows the creation of more granular rules that only trigger when all specified conditions are met.

What actions can be taken when a rule matches?

You can define various actions to be taken when a request matches your rule: * DENY: Completely block the request. * TEMPORARY REDIRECT TO: Redirect the request to a different temporary URL (useful for mitigating certain attacks). * PERMANENT REDIRECT TO: Redirect the request to a different permanent URL. * RATE LIMIT: Limit the number of requests allowed from a specific source within a defined timeframe.

What is the purpose of the "Status" option?

The "Status" option allows you to enable or disable the newly created rule. Disabled rules won't actively block traffic.

**Custom Error Text:**

What is the purpose of Custom Error Text?

This section allows you to define custom error messages displayed to users when specific security events occur. This can provide more informative messages compared to generic error codes.

What information can be included in the custom error text?

You might be able to include details like the error code, any relevant information about the blocked request, or instructions for the user.

**IP Reputation:**

What is IP reputation?

IP reputation refers to the scoring or classification of IP addresses based on their known malicious activity. Security solutions leverage IP reputation databases to identify and potentially block traffic originating from suspicious sources.

What does the "IP Reputation" section allow you to do?

This section lets you manually override the IP reputation for specific IP addresses. You can choose to "Allow" traffic from an IP address even if it has a poor reputation.

When might I use the "IP Allowed" action?

You might use this if a known business partner's IP address is flagged incorrectly or if you trust a specific IP source. However, proceed with caution as allowing IPs with poor reputations can bypass security measures.

**Geo Reputation:**

What is Geo Reputation?

Geo reputation assigns a risk score or classification based on the geographical location of a request's origin. This can be helpful for identifying suspicious traffic patterns originating from specific countries known for cybercrime activity.

How can I create a Geo reputation exception?

You might be able to specify a country and choose the "Allowed" action. This allows traffic from users in that country even if it has a negative reputation. (Use with caution, as it could bypass security measures).

**Allowed URLs:**

What does the "Allowed URL" section allow you to do?

This section allows you to whitelist specific URLs within your website. Requests targeting these URLs won't be filtered by certain security rules, ensuring functionality.

When might I use the "Allowed URL" action?

You might whitelist specific URLs that are flagged by security rules but are essential for website functionality (e.g., URLs for plugins or scripts).

# Traffic 360: General Traffic Logs Traffic Analytics offers a more detailed view of traffic for a specific IP address. This might include additional information and functionalities for analyzing visitor behavior and potential security risks. **User Agent:**

What is the User Agent field?

The User Agent is a string sent by the visitor's browser that identifies the browser type, operating system, and other details.

**General Information:**

What information is shown here?

This section provides details about the visitor associated with the currently selected traffic event. It includes: * IP Address: Visitor's IP address. * Organization: Likely the organization associated with the IP address (based on IP geolocation databases). * Country: Visitor's estimated country based on the IP address.

What actions can I take from this section?

You might be able to: * Block IP: Block future traffic from this specific IP address. (Use with caution) * Allow IP: Allow traffic from this specific IP address even if it triggers security rules. * Block Country: Block future traffic from visitors in this country. (Use with extreme caution as it can impact legitimate users) Allow URL: Allow access to a specific website resource (URL) even if it's normally blocked by security rules.

**Source IP and Destination IP:**

What is the difference between Source IP and Destination IP?

* Source IP: The IP address of the visitor trying to access your website. * Destination IP: The IP address of your web server where the website content resides.

**Referrer URL:**

What does the Referrer URL tell you?

The Referrer URL indicates the website (if any) that directed the visitor to your site. This can be helpful for understanding how users are finding your website.

**Traffic Analytics:**

What is Traffic Analytics?

Traffic Analytics offers a more detailed view of traffic for a specific IP address. This might include additional information and functionalities for analyzing visitor behavior and potential security risks.

**Log Retention and Management:**

For how long are traffic logs stored?

Traffic logs readily available will be 30 days, and more than 30 days would be archived for a period of one year.

What are the options for exporting or archiving traffic logs?

The solution offers functionalities to export logs to a central repository or archive them for future reference (e.g., CSV, SIEM integration).

# ML Based Bot Mitigation

What is bot protection?

Bot protection refers to security measures that aim to identify and differentiate between legitimate human users and automated bots. This helps prevent malicious bots from scraping data, launching denial-of-service attacks, or carrying out other harmful activities on your website.

What is ML Based Bot Mitigation?

This likely refers to bot mitigation using Machine Learning (ML). ML algorithms are trained on vast amounts of data to identify patterns of bot behavior. This allows the security solution to automatically detect and block bots with high accuracy, reducing the need for manual intervention.

What is the benefit of enabling Bot Protection?

By enabling Bot Protection, you can potentially improve website security, prevent fraudulent activities, and ensure a smoother user experience for legitimate visitors.

What is a Captcha challenge?

A Captcha (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge presented to users to distinguish them from bots. These challenges often involve identifying objects in images, solving simple math problems, or ticking a checkbox.

What are Allowed IPs?

This section allows you to specify a list of IP addresses that will bypass bot detection and be granted unrestricted access to your website. This can be useful for trusted bots or specific users who might trigger bot detection rules due to their activity patterns.

How does Prophaze handle new or evolving bot threats?

The effectiveness of the ML model relies on its ability to adapt to new bot tactics. Prophaze updates its models regularly based on observed bot behavior and threat intelligence feeds.

How does Prophaze Bot Protection integrate with other security measures within Prophaze?

Prophaze's bot protection might work in conjunction with other security features like WAF rules and anomaly detection to provide a layered defense against various threats.

# Generating Reports **Generated Reports:**

What information is included in the Attack Reports?

The specific information included depends on Prophaze's configuration. It includes: * Overview of security events during the selected timeframe. * Details about blocked attacks or suspicious activity. * Types of attacks detected (e.g., SQL injection, XSS). * Source IP addresses of potential attackers. * Recommendations for further action (if applicable).

**Integration and Automation:**

Can I integrate Prophaze reports with Security Information and Event Management (SIEM) tools?

Prophaze offer integrations with SIEM tools to centralize security logs and reports alongside data from other security solutions for a more comprehensive view of your security posture.

# Anomaly Detection

What is Anomaly Detection in the context of user behavior?

Anomaly detection in user behavior involves identifying unusual patterns or activities that deviate significantly from normal user behavior. This helps in identifying potential security threats, fraudulent activities, or system malfunctions.

How does Anomaly Detection work?

Anomaly detection systems typically employ statistical methods, machine learning algorithms, or a combination of both to analyze user data and identify outliers. These outliers are then flagged as potential anomalies for further investigation.

What kind of user data is used for Anomaly Detection?

User data such as IP address, device type, login times, and access patterns, can be used for anomaly detection.

What are the benefits of Anomaly Detection?

Anomaly detection helps in preventing fraud, detecting security breaches, improving system performance, and enhancing customer experience by identifying and addressing issues promptly.

How does Anomaly Detection help in preventing fraud?

By identifying unusual user behavior patterns, anomaly detection systems can detect fraudulent activities like account takeover, unauthorized access, and fraudulent transactions.

How do you balance false positives and false negatives in anomaly detection?

By threshold tuning, threat scoring, and human-in-the-loop verification.

# General

How does Prophaze WAF handle false positives?

Prophaze WAF uses advanced algorithms to minimize false positives. However, you can also configure it to allow you to review and whitelist any identified safe traffic patterns.

How does Prophaze WAF impact website performance?

Prophaze WAF is designed to be lightweight and have minimal impact on website performance.

Does Prophaze WAF offer a free trial?

Prophaze offers a free POC for Prophaze WAF to allow you to test its functionality before committing.

Does Prophaze WAF require any hardware or software installation?

No, Prophaze WAF is a cloud-based solution and does not require any additional hardware or software on your end.

What information do I need to provide for onboarding?

You will typically need to provide your domain name, server details, SSL certificate, and temporary access to your DNS management console.

How long does it take to onboard Prophaze WAF?

The onboarding process for Prophaze WAF can be completed within 15 minutes.

What kind of reporting does Prophaze WAF offer?

Prophaze WAF provides detailed reports on security events, blocked attacks, and traffic patterns.

Does Prophaze WAF integrate with other security solutions?

Yes, Prophaze WAF can integrate with other security tools, such as SIEM (Security Information and Event Management) systems.

Does Prophaze WAF support custom rules?

Yes, Prophaze WAF allows you to create custom rules to address specific security threats unique to your application.

Do I need to make changes to my application to use Prophaze WAF?

No, Prophaze WAF typically integrates seamlessly with your existing application infrastructure.

What happens to my website traffic during the installation process?

For cloud-based deployments, there should be minimal disruption to your website traffic during the setup phase. For on-premises or hybrid deployments, a brief service interruption might be necessary during configuration.

Does Prophaze WAF offer API security features?

Yes, Prophaze WAF can secure your APIs by inspecting API traffic for malicious requests and protecting against vulnerabilities like API injection attacks.

How does Prophaze WAF handle Bot Mitigation?

Prophaze WAF employs techniques like analyzing traffic patterns, behavior analysis, and honeypots to identify and block malicious bots and also uses captcha and captchaless challenge to resolve the issue.

Can Prophaze WAF handle large traffic spikes?

Prophaze WAF is built to handle high-volume traffic with minimal performance impact.

Does Prophaze WAF offer geo-blocking capabilities?

Prophaze WAF solutions allow you to block traffic originating from specific geographical locations to mitigate regional threats or comply with data privacy regulations.

Can I integrate Prophaze WAF with a load balancer?

Prophaze WAF can integrate with a load balancer to distribute traffic efficiently and ensure optimal performance while maintaining security.

What support options does Prophaze offer for its WAF solution?

Prophaze offer various support options, including online documentation, knowledge base articles, and tiered support plans with different response times and access levels.

How SAAS Onboarding happens?

Onboarding of SAAS happens in 6 clicks, where the customer registers himself and can get access to the dashboard, where with some minimal prerequisites, onboarding happens. Customers need to have DNS access for this.

How On-Premise Onboarding happens?

The customer is asked for 2-3 VMs depending on the capacity and then we deploy the Prophaze WAF on those VMs.

How does the capacity planning happens?

For on-premise setups with 16 GB RAM and 4 vCPUs, the system supports 25,000 requests per second. For higher demands, perform capacity planning.

Does it support layer 3/4/7 DDOS protection?

Yes it supports all 3 layers for DDOS protection.

Is there rate limiting option available over DDOS?

Yes AI/ML rate limiting is available where it can rate limit the bot attacks and allow only genuine requests at the customer servers.

Does it protects from bad bots or just manage them?

Prophaze Web Security Platform is fully capable and loaded with complete arms and ammunition to handle bot attacks and provides complete protection, not just management.

Is the bot mitigation automated?

This mechanism is fully automated, utilizing the Threat Score Value (TSV) to manage the allow listing or disallow listing of bots.

What kind of applications does it support for protection?

Supports all HTTP or HTTPS applications with a URL accessible via browser, VPN, or the internet.

Where Prophaze Web Application Firewall is hosted and which cloud does it support?

Prophaze WAF supports all cloud providers and is hosted on AWS, Azure, and GCP.

What different types of deployment does it support?

It supports SAAS, Customer Cloud, Customer Data Center and Kubernetes deployment for micro service applications through ingress controller. (Onprem, multi cloud , hybrid)

Is it a AI/ML product?

Yes, it's a complete AI/ML product.

What are benefits, being on Kubernetes architecture?

The main benefits include auto-scaling, cost-effectiveness, workflow automation, and seamless operation in a high availability environment.

Does it have virtual POPS across the globe?

Prophaze WAF operates around 55 virtual POPs globally, with 24 located in India. (Additional POPs can be added based on customer requirements.)

Is PROPHAZE Gartner Listed?

Yes, we are listed in the Gartner.

# Release Notes v2.3.0 ## 1. Introduction This release includes new features and enhancements to the product. The release updates include: ## 1.1. New Features ### 1.1.1 Settings 1\. **Cross Origin Request Header:** Introduces a new feature in the domain settings for each domain, enabling users to enter a value for "cross-origin request". This option relates to the HTTP header Access-Control-Allow-Origin. To enable Cross Origin Request: Go to the settings page and click the edit button for the domain to locate the domain settings to activate the Cross-Origin Request Header.

*Disclaimer: This is an advanced feature, please toggle this feature if your application supports the following configurations, else your application functionality will be affected.* 2\. **Secure Cookie Header:** A new functionality that lets users enable or disable a secure cookie flag for a domain in the domain settings. This will add the header Set-Cookie: SameSite=Strict; path=/; secure; HttpOnly.

To enable secure cookies: Access the settings page, click the edit button for the domain to locate the domain settings, and under security headers, activate the Secure Cookie option. *Disclaimer: This is an advanced feature, please toggle this feature if your application supports the following configurations, else your application functionality will be affected.* 3\. **Clickjacking Protection header:** A new option in the settings allows users to add a security header to protect against clickjacking attacks. In the enabled state, there are two options: * DENY ALL: When selected, it adds the header: X-Frame-Options: DENY * Allow Only Same Origin: This option adds the header: X-Frame-Options: SAMEORIGIN

To enable Clickjacking Protection: Access the settings page, click the edit button for the domain to locate the domain settings, and under security headers, activate the Clickjacking Protection header. *Disclaimer: This is an advanced feature, please toggle this feature if your application supports the following configurations, else your application functionality will be affected.* 4\. **Content Security Policy**: The new feature Content-Security-Policy (CSP) in the settings page is a security mechanism that helps prevent various forms of attacks on web applications, such as Cross-Site Scripting (XSS) and data injection attacks. Disabled (Default):When the CSP header is disabled, no restrictions are applied to the loading of resources (scripts, stylesheets, images, etc.). Upgrade-insecure-requests (Force Reload HTTP Content via HTTPS): This option modifies the behavior of how HTTP content (non-secure) is handled by instructing the browser to upgrade insecure requests to HTTPS (secure).

*Disclaimer: This is an advanced feature. Please toggle this feature if your application supports the following configurations; otherwise, your application's functionality will be affected.* 5. **Cluster-Switcher:** Added cluster switcher on applications page and removed website switcher from applications, load balancers, multi-cloud instances, slack-webhook, and activity logs.

### 1.1.2 Bot Mitigation Added a search bar at the top of the API listing page. This feature will enable users to search for APIs easily. As users type their query, the search results will automatically update to show all APIs that match the entered criteria. **PhantomJs Challenge:** An advanced captcha-less challenge that the user cannot see, only a white screen will be seen just before the website loads. During this, an advanced check is carried out in the backend to check for malicious automated traffic.

### 1.1.3 Traffic * **Consolidate Routing to the Traffic 360 Page**: Instead of utilizing the "Explore Traffic" page for applying filters, all traffic data filtering will now be managed directly within the "Traffic 360" page. * **Geo-location Filter:** Added a new geo-location filter in addition to the existing filters for method, status, and IP. * **Action Buttons:** Implemented CSV export and print buttons for the traffic table, enabling users to export or print the traffic data easily. * **Country Flag in the Table:** Displayed the corresponding country flag next to each geo-location entry in the traffic table for easier identification. * **Search:** Improved the search feature to search in specific fields like IP address, referrer, and request URI.

### 1.2 Signature Updates CRLF Injection Rule: Added one new policy under built in WAF policy. Activating the rule protects against CRLF injection attacks.

### 1.3 Improvements #### 1.3.1 Dashboard Help documentation has been added to the left menu of the dashboard.

#### 1.3.2 Attack Page Modification of 'Attack Type' column value in the Attacks Page.

#### 1.3.3 Settings Reference links have been added to the settings page.

#### 1.3.4 Built in WAF Policies ‘Read Only’ access for built in WAF Policies and exceptions. The user can not toggle the state of the rule and also can not modify the exceptions as well in the WAF-Rules page. #### 1.3.5 Custom WAF Policies Secondary verification has been implemented for deleting rules.

#### 1.3.6 Bot Mitigation The option to add allowed IPs has been enabled, even when bot mitigation is disabled.

#### 1.3.7 API Security We propose adding a search bar at the top of the API listing page. This feature will allow users to perform searches on the available APIs. When a query is entered, the search results will dynamically display all APIs that match the search criteria.

#### 1.3.8 Report Module Improved the functionality of the attack report generation module. # Release Notes v2.4.0 ## 1. Introduction This release introduces new features and improvements to the product. The updates include: ## 1.1. New Features ## 1.1.1 API Dashboard A new opt-in, dedicated API Security Dashboard has been introduced for API Security applications. The new API dashboard feature can be activated through the settings page. The following are the features of the API dashboard: 1\. **Endpoints at risk widget:** A view displaying the top 10 at-risk API endpoints. The following factors determine the risk for each endpoint: * Attack traffic * 401 errors (Unauthorized) * 403 errors (Forbidden) * Other 40X errors can also be considered

The risk score is calculated by assigning weightage based on the listed priority, with attack traffic being the most significant factor, followed by the others in order. 2\. **Geolocation chart:** A geolocation graph that illustrates the distribution of API traffic across various countries.

3\. **Malicious vs suspicious traffic comparison chart:** A graph that compares malicious vs suspicious traffic for a single host/domain. * Suspicious traffic includes 401 (Unauthorized) and 403 (Forbidden) errors. * Malicious traffic represents attack-related traffic.

Additionally, the total traffic can be compared, provided it does not clutter the visualization.
4\. **Top attack types chart:** A bar chart displaying the top 10 types of attacks.

5\. **Top recent attack metrics widget:** A view illustrating the latest attacks targeting an API endpoint.

6\. **Most consumed API endpoints widget:** A bar chart displaying the top 10 endpoints with the highest traffic, based on 2xx and 3xx status codes only. Other status codes represent invalid requests.

7\. **API quality score widget:** A quality score is assigned to a host, independent of specific API endpoints. This score will be calculated based on the following criteria: 1. **Response Content Type (JSON/XML)** a.Evaluate the content type of responses from discovered API endpoints. The ideal response should be in JSON or XML format. Any responses with text/HTML or other invalid content types will negatively impact the score. 2. **Number of Error Codes vs. 200 Status Codes:** a.A higher ratio of error status codes (4xx, 5xx) compared to successful 200 status codes will lower the quality score. Frequent errors suggest a poorly functioning API. 3. **Average Response Time:** a.A threshold value will be established. Any response time exceeding this threshold will be considered poor and negatively affect the score, while times below the threshold will contribute positively. 4. **Average Content Length:** a.A threshold value will be established. Any response time exceeding this threshold will be considered poor and negatively affect the score, while times below the threshold will contribute positively. 5. **HTTPS Traffic:** a.The score will also take into account the use of HTTPS traffic, as secure communication is a best practice. Traffic using HTTP instead of HTTPS may be penalized. This quality score will provide a comprehensive view of the overall health and reliability of the host, factoring in both performance and security metrics.

8\. **Resource-heavy endpoints widget:** Displaying endpoints with high response times and large content lengths may suggest that these API endpoints are handling resource-heavy backend operations.

9\. **Error rate graph:** A time series graph depicting the error rate of a host, where the error rates are based on traffic logs containing error status codes such as 40Xs, 50Xs, and similar.

10\. **Response time graph:** A time series graph displaying the response time of a host over a specified time period.

11\. **New Endpoints Discovered widget:** A card view highlighting newly discovered API endpoints. The data will be filtered to show only those endpoints that have been discovered within the past week (i.e., within the last 7 days).

## 1.1.2 Settings 1\. **Security Header toggle HSTS:** Two States: * Enabled * Disabled Default State: * Disabled When Enabled, the following options will be available: * Preload Option: Preload is a feature that allows your website to be included in the HTTP Strict Transport Security (HSTS) preload list maintained by major browsers like Chrome, Firefox, and Safari. * Include Domains: This option enables you to specify additional domains or subdomains that should also be subject to the same HSTS policy.

2\. **Displaying more data on the activity log:** The activity log now includes the following information: * Name of the account making the change, along with the IP address. * The login and logout times for the account

## 1.2. Improvements Displaying cluster name on the Load Balancer page. Also, the user can change the cluster easily with the new cluster switcher available on this page.

# Release Notes v2.5.0 ### 1. Introduction This release introduces new features and improvements to the product. The updates include: ## 1.1. New Features ## 1.1.1 Traffic 360 1\. **Record count is shown on the traffic analytics page** The total number of requests for the applied filters is displayed in the highlighted area at the top of the page. Additionally, even when no filters are applied, the total count of records based solely on the date-time picker is shown.

2\. **Column Width Standardization:** Adjusted the width of the Referrer and Request URI columns to ensure consistency and a uniform layout across the table. 3\. **Request URI Display Enhancement:** * Modified the Request URI column to display only a truncated version of the URI within the table. * Included a tooltip that reveals the full URI when hovered over, providing access to the complete information without affecting the table layout.

4\. **Tooltip for Filter Dropdowns**: Added a tooltip to the filter dropdowns with the message: "Displaying the top 10 results in the dropdown. Use search to find more options." This guides users on the dropdown functionality and encourages them to search for additional choices if needed.

## 1.1.2 Login & Sign Up Implemented client-side validation and error handling for the Sign-Up page in line with the updated design.

## 1.1.3 2FA Added an option to disable two-factor authentication. \ \
# Release Notes v2.7.0 Build: v2.7.0 | Release Type: Minor | Published Date: 19th Dec 2025 ### 1. Introduction This release focuses on delivering meaningful improvements across usability, performance, and security visibility, ensuring a more reliable and efficient experience for administrators and security teams. Version v2.7.0 introduces multiple enhancements designed to refine existing workflows, improve system responsiveness, and strengthen security monitoring and management capabilities within the WAF Dashboard. ### 2.Release Highlights 19 Enhancements aimed at: * Introducing new and improved features * Optimizing existing workflows for better operational efficiency * Enhancing system performance and stability * Improving visibility and control over security events and configurations ### DDoS Attack Page: Optimize and Enhance DDoS Attack Page Enhancements include full-data search capabilities (including IP and request URI) and improved performance for smoother user experience, especially for 'Prophaze Enterprise' users.

### Logs & Reporting : Enhanced CSV Log Download Updated the CSV log download feature on Traffic and Explore Attacks pages to include all data available under “Show Details” or “Show” buttons. Users can now download comprehensive logs, ensuring no critical information is omitted, improving data analysis and reporting capabilities.

### Enhance Off-Canvas Side Nav with Dynamic Actions and Explore Options Updated the side navigation by replacing the single Explore button with a dropdown containing Explore IP, Explore Referrer, and Explore Request URI. Added popover icons for quick exploration, and dynamically display Block/Allow IP and Block/Allow Country buttons. Ensures action buttons remain visible at the bottom for improved usability and faster access to key actions. ### Dashboard : Interactive Pie Chart on Home Page Enhanced the home page pie chart to be interactive. Clicking on any section of the attack-type chart now displays the full list of attack logs corresponding to that type, enabling faster insights and streamlined investigation of specific attacks. ### Dashboard : Attack Log Filtering by Type Introduced filtering on attack logs by attack type, allowing users to quickly view specific attack categories such as SQL Injection. This enhancement improves data analysis efficiency and enables faster identification of relevant threats.

### Dashboard : Refine Low Severity Alerts and Improve Section Layout Removed “Suspicious traffic” and “Suspicious traffic - Header” from Low Severity alerts to reduce clutter and focus on actionable alerts. Updated alert layout to display request headers and body in separate sections, improving clarity and supporting more efficient alert investigation. ### Attack Analytics: Enhanced Attack Type Display with +X Updated the Attack Analytics table and off-canvas panel to display the first attack type followed by +X when multiple attack types exist. Hovering shows a tooltip with additional attack types, and clicking +X opens the off-canvas panel on the Rule Triggered section. This provides a concise overview while maintaining easy access to detailed attack information.

### Dashboard : Add Flag Icons to Top 10 Country Graphs Enhanced the "Top 10 Attack Originating Countries" and "Top 10 User Originating Countries" graphs by adding small flag icons next to country names. This improves visual clarity and quick identification of countries while maintaining layout integrity and cross-browser compatibility.

### Dashboard : Domain Name Validation Implemented validation for the domain\_name field in False Positive API requests to ensure that only existing domains in the database are accepted. This prevents invalid data entries and improves the accuracy and reliability of API operations. ### Dashboard : Dual Dashboard System for API Security Enabled Applications Introduced a dual dashboard system allowing users to access both App Security and API Security dashboards for applications with API security enabled. Users can switch between views and set their preferred default, providing flexible access to multiple security perspectives.

### Dashboard : Empty State Message for Exceptions Table Added a clear message (“No exceptions added yet”) when the exceptions table is empty. This improves user experience by providing context and feedback, preventing confusion when no data is available.

### WAF Policies: Auto-Generated Names for Unnamed Rules in Activity Log Ensures that rules created without a user-provided name are assigned an auto-generated name based on rule attributes. This name is consistently displayed in the custom WAF policies UI and logged in the activity log, improving traceability and rule identification. ### Attack page: Search Icons for Alert Types Enhanced the Explore Attack page by adding search icons next to each alert type in the Show Details off-canvas. Clicking the icon allows users to quickly filter attacks of the same type, improving workflow efficiency and attack analysis.

### Dashboard: Display Application Version Added visibility of the application version on the dashboard, allowing users to quickly identify the current running version for easier tracking, troubleshooting, and support reference.

### Explore Attacks: Enhanced CSV Download with Additional Data Improved the CSV export on the Explore Attacks page by removing the non-informative Action column and adding additional data fields for richer insights. This enhancement ensures exported logs are more meaningful and useful for analysis and reporting. ### Explore Attacks: Filter Options in Additional Details Off-Canvas Enhanced the Additional Details off-canvas by adding filter (funnel) icons to applicable fields. Users can now apply field-level filters without clearing existing filters, while the explore icon opens a new tab pre-filtered with the selected value. This improves flexibility and efficiency during attack investigation.

### Traffic & Attacks : Dynamic Filter Dropdown Updates Improved filter behavior on Traffic and Attack pages by dynamically refreshing filter dropdown options whenever filters are added or removed. This ensures only relevant and valid options are displayed based on the current dataset, providing a more accurate and consistent filtering experience.

### Dashboard: Improved Data Table Stability and Maintainability Enhanced the dashboard data handling to improve overall stability and consistency across the dashboard. This ensures smoother interactions, reliable data display, and easier future enhancements without impacting existing functionality. ### Dashboard: Terminology Update: Cluster to Region Updated user-facing terminology across the dashboard by replacing “Cluster” with “Region” to improve clarity and align with product direction. This change enhances user understanding while keeping functionality unchanged, with the term “Cluster” retained only where technically relevant.

### Known Limitations (If Any) * This update does not introduce any known limitations and works as expected. ### Impact & Compatibility * No customer action is required. * This release is backward compatible with existing configurations. * Existing rules, policies, and integrations remain unaffected. # Release Notes v2.9.3 Build: v2.9.3 | Release Type: Enhancements | Published Date: 21 Jan 2026 ### 1.Introduction This release focuses on enhancing consistency, accuracy, and usability across the platform. These enhancements improve operational clarity and provide a more predictable and intuitive user experience. ### 2. Enhanced URL Allow list Handling The URL allow list functionality has been enhanced to ensure consistent behavior across the platform. Allow list actions now evaluate only the URI path, ensuring that the same endpoint is handled consistently even when accessed with different query parameters. This improvement provides a more predictable and streamlined allow list management experience across Traffic and Attack views.

#### Customer Impact * Consistent allow list behavior for identical endpoints * Improved accuracy when managing allowed URLs * Reduced duplication and confusion caused by varying query strings ### 3. Standardized URI Path Filtering Across Views Request filtering has been enhanced across the Attack and Traffic views to provide reliable and consistent results. The platform now standardizes filtering, navigation, and data representation using the URI path. Labels and filter terminology have been updated to reflect this behavior across dashboards, tables, and exports. Modules Impacted: * Attack * Traffic * DDoS

Fig. 1: Screenshot from Attack module

Fig. 2: Screenshot from DDoS module

Fig. 3: Screenshot from the Traffic module
### Customer Impact * Accurate filtering based on selected URI paths * Improved investigation and analysis workflows * Consistent terminology across the user interface ### Overall Impact * Improved dashboard clarity and data accuracy * Consistent URI handling across UI * Enhanced allow list reliability * Better UX and reduced user confusion ##
# Release Notes v2.11.0 Build: v2.11.0 | Release Type: Minor | Published Date: 10 Feb 2026 ## Introduction: This release introduces new capabilities and enhancements designed to simplify configuration, improve observability, and provide greater operational flexibility on the Prophaze dashboard. ### New Features #### 1.Custom SSL Certificate Upload and Automated CDN DNS Mapping The Prophaze dashboard now supports direct upload of custom SSL certificates along with automated CDN DNS configuration. #### Key highlights: * Secure upload and management of custom SSL certificates directly from the dashboard. * Automatic domain mapping to the CDN upon configuration, eliminating manual DNS steps.

Figure 1: Option for secure upload
* Centralized visibility of CDN DNS details through a dedicated CDN DNS Settings section.

Figure 2: Uploaded SSL certificate #### Key Benefits: * Simplified SSL and CDN setup process * Faster deployment with reduced configuration overhead * Improved visibility and management of CDN configurations ### 2.To enhance troubleshooting and request traceability, Request ID support has been added to log views and search functionality. #### Key highlights: * Request IDs are now displayed within detailed views for both Traffic and Attack logs.

Figure 3: Traffic Details Page

Figure 4: Attack Details Page * Log entries can be searched directly using a Request ID across both log types. #### Key Benefits: * Faster investigation of specific requests * Improved correlation between traffic activity and security events * Enhanced operational visibility ## Changes: #### 1.Expanded Proxy Connection Timeout Configuration Validation rules for proxy connection timeout settings have been updated to provide greater flexibility. #### Key highlights: * The minimum configurable proxy connection timeout has been reduced to 1 second.

Figure 5: Connect Timeout field

Figure 6: Mandatory message alert to enter the right value * The default timeout value remains unchanged. #### Key Benefits: * Greater control over timeout behavior * Improved adaptability for performance-sensitive and custom deployment scenarios
# Release Notes v3.0.0 Build: v3.0.0 | Release Type: Major | Published Date: 10 March 2026 ## Overview: We are pleased to announce the release of Version 3.0.0. This release introduces two new features aimed at improving user management and collaboration within the organization. In addition, the release includes general bug fixes and minor improvements to enhance overall stability and user experience. ### Highlights of this release: * Introduction of Roles and Permissions to manage user access more effectively. * Addition of Organization Management to enable better collaboration and structured account management. * General bug fixes and improvements to ensure a smoother and more reliable experience. ## New Features ### 1. Roles and Permissions Roles and permissions have been introduced across the application to improve access management. Two roles are currently available: * Admin - Provides full access to all features and settings within the application. * Read-only - Allows users to view information and resources without making any changes. This update helps to ensure that users have appropriate access based on their responsibilities. ### 2. Organization Management The Dashboard now supports organization-based management to imp1rove collaboration and resource management. #### Key highlights: * Organization Accounts - Resources and settings are now managed under an organization rather than individual users.

* User Collaboration - Admins of the organization can invite multiple users to work together within the same organization.

* Role Assignment - Invited users can be assigned roles such as Admin or Read-only to control their level of access.

This enhancement makes it easier for teams to manage users, collaborate effectively, and maintain structured access control.

# API Security Features of Prophaze APIs (Application Programming Interfaces) are essential for integrating different systems and applications. However, they are prime targets for cyberattacks, making API security a critical concern. Prophaze provides advanced security features to ensure your APIs remain secure, efficient, and compliant with modern security standards. Below is a detailed explanation of how Prophaze secures APIs and protects sensitive data. ## Comprehensive API Monitoring

APIs (Application Programming Interfaces) are a critical component of modern digital ecosystems, enabling seamless communication between applications, services, and users. However, they also represent a significant attack vector for cyber threats. Prophaze provides Comprehensive API Monitoring to ensure complete visibility, security, and control over your API landscape. This feature helps organizations detect anomalies, prevent security breaches, and maintain optimal API performance. ### Key Aspects of API Monitoring #### 1. Total API Endpoints Prophaze continuously monitors all APIs currently in use within your environment. This includes both public and internal APIs. By maintaining a real-time inventory of all API endpoints, Prophaze helps organizations: * Understand the full scope of their API exposure. * Identify critical API dependencies. * Ensure proper governance of all active API services. #### 2. Newly Discovered Endpoints With the rapid evolution of applications, new APIs are frequently deployed. Prophaze identifies and tracks any newly added or unknown APIs within the system, ensuring that: * Security teams are aware of all API changes. * Compliance and regulatory requirements are met by maintaining an up-to-date API inventory. This feature helps mitigate the risk of API sprawl, which can lead to undocumented and potentially insecure APIs being left exposed. #### 3. Malicious and Suspicious Requests APIs are often targeted by cyber threats such as: * SQL Injection – Attackers attempt to execute malicious database queries. * Cross-Site Scripting (XSS) – Malicious scripts are injected into API responses. * API Abuse & Bots – Automated bots attempt to exploit APIs. * Credential Stuffing – Attackers use leaked credentials to gain unauthorized access. * DDoS Attacks – Large-scale traffic floods APIs to cause service disruption. Prophaze continuously analyzes incoming requests to detect and block such threats in real time, ensuring APIs remain secure from unauthorized access and exploitation. #### 4. API Traffic Analysis Prophaze monitors API traffic patterns to detect anomalies in real-time. This includes: * Baseline Normal Traffic: Establishing a baseline of normal API usage. * Anomalous Behavior Detection: Identifying unusual spikes or drops in traffic. * Rate Limiting Enforcement: Preventing excessive requests that may indicate abuse or attack attempts. * Geolocation & User-Agent Tracking: Analyzing request sources for potential threats. By leveraging advanced analytics and AI-driven detection mechanisms, Prophaze ensures that API traffic remains secure and optimal. ### Why Comprehensive API Monitoring Matters * Real-Time Threat Detection: Identify and mitigate security threats as they occur. * Improved API Governance: Gain full visibility over all API endpoints. * Enhanced Compliance: Maintain an up-to-date inventory for regulatory compliance. * Optimized Performance: Prevent abuse and ensure APIs function efficiently. By implementing Comprehensive API Monitoring, organizations can proactively secure their APIs, ensuring data integrity, performance optimization, and protection against evolving cyber threats.

# API security scoring API security scoring is a methodology used to evaluate the security and performance of APIs. This scoring mechanism assigns a health score (out of 100) to APIs based on multiple factors. The purpose of API security scoring is to ensure that APIs are secure, reliable, and perform efficiently. A higher score signifies a well-secured and high-performing API, whereas a lower score indicates potential vulnerabilities and performance bottlenecks. \

### API Score Calculation The API score is determined based on the following key parameters: #### 1. Response Time * Definition: Measures how quickly an API responds to requests. * Impact on Score: Faster response times contribute to a higher API security score, while slower response times lower the score. * Best Practices: 1. Optimize backend processing. 2. Use caching mechanisms. 3. Reduce unnecessary computations in API responses. #### 2. Error Ratio * Definition: Represents the frequency of errors encountered by the API. * Impact on Score: * A high ratio of error codes (4xx, 5xx) negatively affects the score. * A lower error rate (higher percentage of 200 status codes) improves the score. * Best Practices: 1. Implement proper error handling. 2. Reduce server crashes by optimizing code and database queries.Conduct regular API testing and monitoring. #### 3. HTTPS Support * Definition: Ensures secure encrypted communication between clients and the API. * Impact on Score: APIs using HTTPS receive a higher score, while those using HTTP are penalized. * Best Practices: * Enforce HTTPS for all API endpoints. * Obtain valid SSL/TLS certificates. * Regularly update and renew certificates. #### 4. Content Encoding * Definition: Ensures that responses maintain data integrity and security. * Impact on Score: Incorrect or missing content encoding lowers the score. * Best Practices: 1. Ensure proper response content-type headers (e.g., application/json, application/xml). 2. Avoid returning responses with incorrect content types such as text/html unless explicitly needed. # Host-Based API Quality Score A quality score is assigned to an API host, independent of individual API endpoints. This score considers various metrics to evaluate the overall reliability and security of the host. #### 1. Response Content Type (JSON/XML) * Definition: Evaluates the format of API responses. * Impact on Score: 1. JSON and XML are preferred response formats. 2. Responses with invalid formats (e.g., text/html when JSON is expected) negatively impact the score. * **Best Practices:** 1. Ensure proper response content-type headers (e.g., application/json, application/xml). 2. Avoid returning HTML or unstructured text in API responses. #### 2. Number of Error Codes vs. 200 Status Codes * Definition: Measures the ratio of unsuccessful (4xx, 5xx) to successful (200) responses. * Impact on Score: 1. A higher number of error responses reduces the score. 2. A higher success rate (200 responses) contributes positively. **Best Practices:** 1. Monitor and reduce API failures 2. Implement meaningful error messages and exception handling. 3. Improve API stability by reducing downtime. #### 3. Average Response Time * Definition: Assesses how quickly an API responds to requests. * Impact on Score: 1. Responses exceeding the defined threshold lower the score. 2. Faster responses contribute to a higher score. * **Best Practices:** 1. Optimize database queries. 2. Implement caching strategies. 3. Minimize unnecessary API calls. #### 4. Average Content Length * Definition: Evaluates the size of API responses. * Impact on Score: 1. Large response sizes exceeding the threshold reduce the score. 2. Optimized, minimal responses contribute positively. * **Best Practices**: 1. Avoid excessive data in API responses. 2. Use pagination for large datasets. 3. Compress responses when applicable. #### 5. HTTPS Traffic * Definition: Determines whether the API enforces secure communication. * Impact on Score: 1. API traffic using HTTPS gains a higher score. 2. HTTP-only APIs are penalized due to security risks. * **Best Practices:** 1. Implement HTTPS enforcement at the level. 2. Use HSTS (HTTP Strict Transport Security) to force secure connections. 3. Regularly audit SSL/TLS configurations. ## Protecting API Endpoints **Endpoints At Risk**\ API endpoints are crucial access points for your application. Malicious or suspicious attempts to exploit these endpoints can jeopardize the security of your entire system. For instance, specific APIs like /api/v3/pet/1 may become targets for attackers attempting to bypass security measures. Understanding which endpoints receive malicious requests helps you identify potential vulnerabilities early on. **Resource-Heavy Endpoints**\ Certain API endpoints can be resource-intensive, leading to performance bottlenecks. These endpoints may experience high response times or large content lengths, which can indicate that they are handling resource-heavy backend operations. Monitoring the performance of these endpoints provides insights into which parts of the application are putting the most strain on your resources, helping you optimize both security and performance. **Why This Matters**\ By knowing which API endpoints are at risk or are resource-heavy, you can take proactive steps to improve their security and performance. Securing vulnerable endpoints and optimizing those that consume excessive resources helps maintain the integrity and responsiveness of your system, ensuring a smooth user experience while minimizing exposure to threats. *** ## Threat Detection and Prevention **Real-Time Threat Detection**\ Prophaze's threat detection capabilities are designed to identify malicious activities in real-time. Key threats such as SQL injection, cross-site scripting (XSS), and brute force attacks are detected as they occur, allowing for immediate action to prevent damage. A bar chart displaying the top 10 types of attacks helps visualize the most common and concerning threats in your environment. **Latest Attack Examples** * SQL Tautologies Attack: SQL injection attacks, like tautologies, exploit vulnerabilities in database queries. Attackers manipulate queries to return true for any condition, allowing unauthorized access or data manipulation. An example of such an attack originating from IP addresses in Thailand was flagged and successfully blocked, demonstrating the system’s real-time response capabilities. * Geographical Attack Mapping: Prophaze also provides geographical attack mapping, allowing you to track where attacks are originating from globally. This feature is invaluable for taking targeted actions, such as blocking traffic from suspicious regions or investigating threats more closely based on their geographical origin. **Why This Matters**\ Real-time threat detection is essential for stopping attackers before they can cause significant harm. By detecting malicious activities as they happen, you ensure that your system is always protected, minimizing the potential for data breaches or other security incidents. The geographical mapping feature further empowers your team to make informed decisions about where to focus efforts for better security and risk mitigation. ![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeElgpRwBlEPurkLOKEhZnnxk-lm2svGMy4kdBwtYN5JkhJosAw9BO5H1gqENhpaaNzDo4f-Ko8E_l76QMJTLAEDE1KDBm87P_tfGFamQSfM0ToUU_UNKryqyT-560M-BS8Ddzg?key=JNNncIHiGfgDp-np0-4Hq9lR)
## API Analytics and Reporting Traffic Comparison\ A comprehensive traffic comparison graph provides insights into the fluctuations in normal and suspicious traffic over time. By visualizing these trends, you can spot anomalies and potential threats that deviate from typical traffic patterns. This comparison helps you track when malicious activity spikes, enabling your security team to respond swiftly to unusual behavior and mitigate any risks before they escalate. Error Codes Analysis\ The error codes analysis is crucial for identifying problems and possible attacks within your system. A time series graph presents the error rate for a specific host, based on traffic logs that contain error status codes such as: * 404: Endpoint Not Found: Occurs when users or attackers attempt to access an invalid or non-existent endpoint. * 500: Server Error: Typically indicates an issue on the server-side, such as an unhandled exception or misconfiguration. * 403: Access Denied: Indicates a failed attempt to access a resource without proper authentication or authorization. By monitoring these error rates, you can uncover issues with the system’s stability or security, helping you address potential threats like misconfigurations, unauthorized access attempts, or performance degradation. Recently Discovered Endpoints\ This report shows newly identified APIs and their discovery dates, with the data filtered to include only those endpoints found within the last 7 days. This feature helps you keep track of any newly added or hidden endpoints, ensuring that any exposed vulnerabilities are addressed in a timely manner. By continuously monitoring and identifying new endpoints, you can stay ahead of potential risks and ensure the integrity of your entire API infrastructure. **Why This Matters**\ API analytics and reporting provide invaluable insights that help optimize your infrastructure. By monitoring traffic trends, error codes, and newly discovered endpoints, you can proactively identify and resolve security vulnerabilities, improving overall system stability and performance. These insights enable your team to take informed actions, ensuring the protection of your resources and a seamless user experience. ![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcqQ0rMEghHa0u5MxnHv3gAVoJXnxScB7u-FoxabCZcUJgPUXugvrNnNb5hF98IWJRAZpoUu_zYnXM74rol31sS8sgSgaN_drS6YL3UM2YU5eYxpuSe6S0kS5EFHp_RDULT74d1Mg?key=JNNncIHiGfgDp-np0-4Hq9lR) #### 7. Advanced API Security Features Base URI Management\ Base URI management allows you to specify the root address of your API (e.g., /api/v1). This feature helps you focus protection on specific sections of your application rather than applying blanket security measures across the entire API. By managing base URIs, you can more efficiently allocate resources and apply targeted security controls to the most sensitive or critical parts of your API. **HTTPS Support**\ To ensure secure communication between your APIs and users, HTTPS support encrypts the data exchanged between the client and the server. This encryption protects against eavesdropping, man-in-the-middle attacks, and tampering, making it a crucial feature for securing sensitive data and safeguarding user privacy. **Dynamic Threat Detection**\ Leveraging artificial intelligence (AI) and machine learning (ML), dynamic threat detection analyzes historical data to detect anomalies in API usage patterns. By continuously learning from usage trends and evolving threats, this feature can identify unusual activity that may indicate a security breach. This proactive approach allows for the early detection of potential vulnerabilities and ensures real-time protection against emerging threats. **Why This Matters**\ These advanced security features not only protect your APIs but also optimize their security and efficiency. By focusing on specific sections of your API with base URI management, ensuring encrypted communication with HTTPS, and using AI-driven dynamic threat detection, you can significantly enhance the robustness of your security posture and minimize the risk of data breaches or attacks. *** ## Key Highlights * Automatic Discovery: Prophaze ensures that even hidden APIs are identified and secured, helping you maintain visibility over your entire API infrastructure, regardless of how obscure or private the endpoints may be. * Real-Time Attack Mitigation: The system proactively stops attacks like SQL injections as they happen, preventing any damage or exploitation in real-time. * Enhanced API Visibility: Gain deep insights into your API’s traffic, usage patterns, and performance, allowing for better decision-making and optimization. Comprehensive Reports: With visual dashboards and detailed logs, Prophaze simplifies tracking and compliance by providing easy-to-understand data and actionable insights into your API's security status. # How to Enable API Security and Dashboard ## 1.To enable API security and configure the settings in Prophaze, follow these steps: 1. Login Process 1. Navigate to Applications Settings 2. Log in to the Prophaze Dashboard. 3. Go to Settings > Applications. You will be presented with a list of applications hosted under Prophaze. 2. Enable API Security 3. Configuration * Select the application you want to configure. * Follow the prompts to enable API security, ensuring that your APIs are adequately protected with the latest security measures, including dynamic threat detection and HTTPS support ## 2. Configure API Security for an Application **1. Locate the Desired Application** * First, locate the application you want to configure (e.g., petstore1.kubewaf.com) in the Prophaze dashboard. **2. Edit Application Settings** * Click on the Pencil Tool next to the application to edit its settings. **3. Enable API Security** * Toggle the Enable API Security option to activate API protection for the selected application. This ensures that the necessary security measures, such as dynamic threat detection, are applied to safeguard your APIs.

## Configure Base URIs **What is a Base URI?**\ A Base URI is the root address of your API. It serves as the starting point for all API requests. By specifying a Base URI, you can define the scope of the protection that applies to specific parts of your application. **Example Base URIs:** * /api/v3/user * /api/v3/pet **How to Add Base URIs:** 1. Enter the specific Base URI for your application (e.g., /api/v3/user). 2. Click the Add button to include multiple URIs. 3. Example: Add /api/v3/user and /api/v3/pet to secure these endpoints specifically. 4. If you're unsure which Base URI to use, leave this field empty to cover all API requests. **Why Base URIs Matter:** * By specifying specific Base URIs, you ensure that only requests matching these paths are processed by the API security engine. * This allows for fine-grained control over which API endpoints are protected, ensuring more efficient processing by limiting the scope of security measures to the most relevant traffic. *** ## 3. Enable API Dashboard 1\. Toggle the Enable API Dashboard Option * Enable the API Dashboard by toggling the option to switch to the enhanced analytics view. API Analytics Dashboard Features: * Real-Time Insights: Get real-time data on API performance, helping you track usage and detect issues immediately. * Detailed Traffic Analysis: The dashboard shows detailed analysis of traffic, including identifying suspicious and malicious requests. * Enhanced Reporting & Monitoring: The new dashboard provides more robust reporting and monitoring features compared to the legacy dashboard, offering greater visibility into your API’s health and security. *** ## 4. Review and Save Settings After entering the required Base URIs and enabling the API Dashboard, click Save to finalize the configuration and complete the onboarding process. ***
# API Security Section The API Security Section in the Prophaze dashboard provides a detailed view of your application’s API endpoints, their activity, and security status. This section is designed to help you secure your APIs, monitor traffic, and analyze potential threats in real-time. *** ## 1. Dashboard Overview * Total API Endpoints: Displays the total number of APIs being monitored, such as "16 endpoints." * Total API Requests: Tracks the total number of API requests processed in the last 24 hours, for example, "2 requests."

## 2. Endpoint List **Purpose**\ The Endpoint List provides a comprehensive, detailed table of all detected API endpoints and their configurations. This feature allows you to view key information for each endpoint, enabling easier management and security of your APIs. For each endpoint, the following details are available: * Method: The HTTP method used for the API request, such as GET, POST, PUT, DELETE, etc. * URI: The API path that defines the resource, for example, /api/v3/user, /api/v3/pet/findByStatus. * Action: Available options to configure, monitor, or secure the endpoint. These actions let you manage and protect each API endpoint as necessary. *** **Example Endpoints:** 1. DELETE /api/v3/user/ww 2. Purpose: Deletes a user with the identifier "ww." Action: Typically configured for deletion operations. You can monitor and apply security measures to prevent unauthorized access or accidental deletions. 3. GET /api/v3/pet/findByStatus 4. Purpose: Fetches pets based on their status (e.g., available, sold, or pending). Action: Allows fetching data from the system. Monitoring usage of such endpoints is crucial for ensuring it isn't used inappropriately or excessively. 5. POST /api/v3/user/createWithList 6. Purpose: Creates a user with a list of attributes. Action: Monitors the creation of new users and ensures secure handling of the input data, protecting against threats like data injection or misuse.

## 3. Endpoint Overview The Endpoint Overview section provides a comprehensive breakdown of each API endpoint, helping you monitor its performance and security. This detailed view allows you to manage and optimize your APIs more effectively while safeguarding them from potential threats. *** **Endpoint Details:** * URI\ The URI (Uniform Resource Identifier) is the specific address of the API endpoint. For example, /api/v3/pet/findByStatus defines the path for fetching pets based on their status. This identifier helps you pinpoint the exact location of each API within your application. * Endpoint Method\ The HTTP method used by the endpoint indicates the action being performed. Common methods include: * GET: Retrieves data from the API. * POST: Sends data to the server, often for creating or updating resources. * DELETE: Removes a resource from the system. * PUT: Updates an existing resource. * Headers\ This section displays any custom headers that are required for the endpoint. These could include authorization tokens, content types, or other metadata needed for proper request handling. * Query Parameters\ Query Parameters are optional parameters appended to the URI that can alter the API’s response. For example, a status query parameter could be used to filter results, such as showing only pets that are available or sold. * Body Parameters\ For POST or PUT requests, Body Parameters refer to the data sent in the body of the request. These parameters typically contain the details necessary to create or modify a resource, such as user information or pet attributes. * Endpoint Traffic\ Endpoint Traffic tracks the total number of requests made to the API endpoint over a specific period, such as the last 24 hours. This metric helps you understand the usage patterns of the endpoint and identify any traffic anomalies or overloads. * Endpoint Attacks\ The Endpoint Attacks section shows whether any malicious activities or security threats have been detected targeting the endpoint. This helps you monitor and respond to attacks, such as SQL injections or brute-force attempts, ensuring the endpoint remains secure.

## 4. Analytics Sections Analytics tools offer a comprehensive way to monitor and secure your APIs in real-time, enabling you to identify patterns and threats effectively. Here's how each tool contributes to the security and performance of your endpoints: *** ## Analytics Tools: * Attack Analytics\ Provides a visual representation of attack patterns targeting specific APIs, updated for the last 24 hours. This helps you visualize threats such as SQL injections, DDoS attacks, or brute force attempts, allowing you to take timely actions to protect your endpoints. * Traffic Analytics\ Tracks the traffic flow to the API and identifies anomalies over time. This feature helps detect unexpected spikes in traffic or unusual usage patterns that might indicate malicious behavior or system overloads. * Top IP Addresses\ Displays the most active IP addresses interacting with the API. This can help you identify sources of excessive requests and suspicious activity, providing insight into potential threats or abusive behavior. * Top Countries\ Shows the geographic regions generating the most API requests. This allows you to analyze traffic patterns and detect whether unusual amounts of traffic are coming from specific regions, potentially signaling an attack or misuse from certain locations. * Status Codes\ Displays the response status codes returned by the API (e.g., 200, 400, 404). Monitoring status codes helps you identify broken endpoints (404 errors), unauthorized access (401 errors), or server-side issues (500 errors) that could indicate attacks or other problems.

## 5. Key Features #### Headers, Query Parameters, and Body Parameters * This section provides insights into the inputs used for each API call, including headers, query parameters, and body parameters, which are essential for securing and validating requests. * Example: Query Parameter: The status parameter for /api/v3/pet/findByStatus determines which pets to fetch based on their status (e.g., available, sold, etc.). #### Attack Insights * Tracks malicious activities targeting APIs, showing whether an endpoint has been targeted by attacks. For example, a report may show "0 attacks" on a particular endpoint, which helps you identify vulnerabilities and take preventive measures before issues arise. #### Traffic Analysis * Provides real-time data on legitimate and malicious traffic interacting with APIs. This helps you analyze traffic trends and take corrective actions, such as blocking abusive IP addresses or limiting traffic from suspicious sources.

## 6. Use Case Example #### **GET /api/v3/pet/findByStatus** ● Purpose: Fetches a list of pets filtered by their status. ● Traffic & Security: ○ Endpoint Traffic: Shows how many requests are being made to this endpoint. ○ Endpoint Attacks: Tracks if this endpoint has been targeted by attackers. ● Analytics: Administrators can monitor which IPs are accessing the API and where the traffic is coming from. ## 7. Benefits of the API Security Section ● Comprehensive Monitoring: Provides complete visibility into API traffic and activity. ● Enhanced Security: Monitors potential threats and helps protect APIs against vulnerabilities. ● Actionable Insights: Offers detailed analytics and logs for real-time decision-making. Prophaze’s API Security solution is designed to provide end-to-end protection for your APIs. From real-time monitoring and attack prevention to detailed analytics and reporting, Prophaze ensures that your API infrastructure is secure, efficient, and ready to handle modern threats.
# CVE-2025

CVE	CVE Description	Reference
CVE-2025-27218	Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.	https://www.exploit-db.com/exploits/52344
CVE-2025-49132	Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.	https://www.exploit-db.com/exploits/52341
CVE-2025-49113	Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.	https://www.exploit-db.com/exploits/52324
CVE-2025-45542	SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to improper input validation, allowing attackers to inject SQL queries.	https://www.exploit-db.com/exploits/52314
CVE-2025-3605	The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.7. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the flr_blocks_user_settings_handle_ajax_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.	https://www.exploit-db.com/exploits/52291
CVE-2025-2011	The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	https://www.exploit-db.com/exploits/52285
CVE-2025-46041	A stored cross-site scripting (XSS) vulnerability in Anchor CMS v0.12.7 allows attackers to inject malicious JavaScript via the page description field in the page creation interface (/admin/pages/add).	https://www.exploit-db.com/exploits/52327
CVE-2025-29306	An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component.	https://www.exploit-db.com/exploits/52267
CVE-2025-5298	A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /admin/betweendates-detailsreports.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.	https://www.exploit-db.com/exploits/52312
CVE-2025-46822	OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized access to sensitive internal files. Commit c835c6f7799eacada4c0fc77e0816f250af01ad2 contains a patch for the issue.	https://www.exploit-db.com/exploits/52304
CVE-2025-32370	Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other extensions. NOTE: this is a separate issue not necessarily related to SVG or XSS.	https://www.exploit-db.com/exploits/52290
CVE-2025-24893	XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.	https://www.exploit-db.com/exploits/52136
CVE-2025-31131	YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. This vulnerability is fixed in 4.5.2.	https://www.exploit-db.com/exploits/52135
CVE-2025-2294	The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.	https://www.exploit-db.com/exploits/52125
CVE-2025-29471	Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.	https://www.exploit-db.com/exploits/52117
CVE-2025-2126	A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the argument title leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/52089
CVE-2025-0868	A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized attacker could send arbitrary Python code to be executed via /api/remote endpoint. This issue affects DocsGPT: from 0.8.1 through 0.12.0.	https://www.exploit-db.com/exploits/52145
CVE-2025-24813	Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) support for partial PUT (enabled by default) a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.	https://www.exploit-db.com/exploits/52134
CVE-2025-49619	Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper sanitization of Jinja2 template input allows authenticated users to inject crafted expressions that are evaluated on the server, leading to blind remote code execution (RCE).	https://www.exploit-db.com/exploits/52335

# CVE-2024

CVE	CVE Description	Reference
CVE-2024-40422	The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.	https://www.exploit-db.com/exploits/52066
CVE-2024-32113	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.	https://www.exploit-db.com/exploits/52020
CVE-2024-32113	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.	https://www.exploit-db.com/exploits/52020
CVE-2024-33559	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.	https://github.com/absholi7ly/WordPress-XStore-theme-SQL-Injection#poc
CVE-2024-34241	A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course notifications.	https://grumpz.net/cve-2024-34241-a-step-by-step-discovery-guide
CVE-2024-29291	An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the access control appropriately for the type of data that may be logged.	https://www.exploit-db.com/exploits/52000
CVE-2024-23897	Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.	https://github.com/godylockz/CVE-2024-23897/blob/main/jenkins_fileread.py
CVE-2024-23897	Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing unauthenticated attackers to read arbitrary files on the Jenkins controller file system.	https://www.exploit-db.com/exploits/51993
CVE-2024-31777	File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.	https://www.exploit-db.com/exploits/51975
CVE-2024-24724	Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization.	https://www.exploit-db.com/exploits/51962
CVE-2024-24495	SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafted GET request.	https://www.exploit-db.com/exploits/51953
CVE-2024-24494	Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vitamins, laundry, alcohol and meat parameters in the add-tracker.php and update-tracker.php components.	https://www.exploit-db.com/exploits/51952
CVE-2024-28595	SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in update-admin.php.	https://www.exploit-db.com/exploits/51911
CVE-2024-27620	An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API.	https://www.exploit-db.com/exploits/51869
CVE-2024-27746	SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address parameter in the index.php component.	https://www.exploit-db.com/exploits/51838
CVE-2024-4577	In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.	https://www.exploit-db.com/exploits/52047
CVE-2024-36597	Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.	https://www.exploit-db.com/exploits/52046
CVE-2024-36598	An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file.	https://www.exploit-db.com/exploits/52045
CVE-2024-36599	A cross-site scripting (XSS) vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter at insertClient.php.	https://www.exploit-db.com/exploits/52042
CVE-2023-27636	Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.	https://www.exploit-db.com/exploits/52035
CVE-2024-32136	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xenioushk BWL Advanced FAQ Manager.This issue affects BWL Advanced FAQ Manager: from n/a through 2.0.3.	https://www.exploit-db.com/exploits/52024
CVE-2024-32113	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.	https://www.exploit-db.com/exploits/52020
CVE-2024-33559	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 8theme XStore allows SQL Injection.This issue affects XStore: from n/a through 9.3.5.	https://www.exploit-db.com/exploits/52019
CVE-2024-34241	A cross-site scripting (XSS) vulnerability in Rocketsoft Rocket LMS 1.9 allows an administrator to store a JavaScript payload using the admin web interface when creating new courses and new course notifications.	https://www.exploit-db.com/exploits/52018
CVE-2024-33288	Prison Management System Using PHP -SQL Injection Authentication Bypass	https://www.exploit-db.com/exploits/52017
CVE-2024-3378	A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.2.0.160 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259501 was assigned to this vulnerability.	https://www.exploit-db.com/exploits/52009
CVE-2024-0264	A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /LoginRegistration.php. The manipulation of the argument formToken leads to authorization bypass. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249820.	https://www.exploit-db.com/exploits/52008
CVE-2024-0187	The Community by PeepSo WordPress plugin before 6.3.1.2 does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	https://wpscan.com/vulnerability/b4600411-bee1-4cc8-aee9-0a613ac9b55b/
CVE-2024-0190	A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0 and classified as problematic. This issue affects some unknown processing of the file add_quiz.php of the component Quiz Handler. The manipulation of the argument Quiz Title/Quiz Description with the input </title><scRipt>alert(x)</scRipt> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249503.	https://vuldb.com/?id.249503
CVE-2024-0233	The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	https://wpscan.com/vulnerability/04a708a0-b6f3-47d1-aac9-0bb17f57c61e/
CVE-2024-0238	The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and does not ensure that the post to be updated belong to the plugin, allowing unauthenticated users to update arbitrary post metadata.	https://wpscan.com/vulnerability/774655ac-b201-4d9f-8790-9eff8564bc91/
CVE-2024-0239	The Contact Form 7 Connector WordPress plugin before 1.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against administrators.	https://wpscan.com/vulnerability/b9a4a3e3-7cdd-4354-8541-4219bd41c854/
CVE-2024-0250	The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.	https://wpscan.com/vulnerability/321b07d1-692f-48e9-a8e5-a15b38efa979/
CVE-2024-0262	A vulnerability was found in Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Admin/News.php of the component Create News Page. The manipulation of the argument News with the input </title><scRipt>alert(0x00C57D)</scRipt> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249818 is the identifier assigned to this vulnerability.	https://github.com/trickest/cve/blob/main/2024/CVE-2024-0262.md
CVE-2024-43425	A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.	https://www.exploit-db.com/exploits/52350
CVE-2024-11956	A vulnerability, which was classified as critical, has been found in Pimcore customer-data-framework up to 4.2.0. Affected by this issue is some unknown functionality of the file /admin/customermanagementframework/customers/list. The manipulation of the argument filterDefinition/filter leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component.	https://www.exploit-db.com/exploits/52193
CVE-2024-53584	OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter.	https://www.exploit-db.com/exploits/52193
CVE-2024-28000	Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Privilege Escalation.This issue affects LiteSpeed Cache: from 1.9 through 6.3.0.1.	https://www.exploit-db.com/exploits/52328
CVE-2024-10758	A vulnerability, which was classified as critical, was found in code-projects/anirbandutta9 Content Management System and News-Buzz 1.0. This affects an unknown part of the file /index.php. The manipulation of the argument user_name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is distributed under two entirely different names.	https://www.exploit-db.com/exploits/52174
CVE-2024-55661	Laravel Pulse is a real-time application performance monitoring tool and dashboard for Laravel applications. A vulnerability has been discovered in Laravel Pulse prior to version 1.3.1 that could allow remote code execution through the public `remember()` method in the `Laravel\Pulse\Livewire\Concerns\RemembersQueries` trait. This method is accessible via Livewire components and can be exploited to call arbitrary callables within the application. An authenticated user with access to Laravel Pulse dashboard can execute arbitrary code by calling any function or static method in which the callable is a function or static method and the callable has no parameters or no strict parameter types. The vulnerable to component is `remember(callable $query, string $key = '')` method in `Laravel\Pulse\Livewire\Concerns\RemembersQueries`, and the vulnerability affects all Pulse card components that use this trait. Version 1.3.1 contains a patch.	https://www.exploit-db.com/exploits/52319
CVE-2024-8522	The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	https://www.exploit-db.com/exploits/52171
CVE-2024-45440	core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.	https://www.exploit-db.com/exploits/52266
CVE-2024-12483	A vulnerability classified as problematic has been found in Dromara UJCMS up to 9.6.3. This affects an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.	https://www.exploit-db.com/exploits/52264
CVE-2024-42640	angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uploads. This leads to the execution of previously uploaded content and enables the attacker to achieve code execution on the server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.	https://www.exploit-db.com/exploits/52253
CVE-2024-48573	A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature.	https://www.exploit-db.com/exploits/52164
CVE-2024-51378	getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.	https://www.exploit-db.com/exploits/52172
CVE-2024-44541	evilnapsis Inventio Lite Versions v4 and before is vulnerable to SQL Injection via the "username" parameter in "/?action=processlogin."	https://www.exploit-db.com/exploits/52263
CVE-2024-11728	The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'visit_type[service_id]' parameter of the tax_calculated_data AJAX action in all versions up to, and including, 3.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.	https://www.exploit-db.com/exploits/52265
CVE-2024-0566	The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.	https://www.exploit-db.com/exploits/52247
CVE-2024-0399	The WooCommerce Customers Manager WordPress plugin before 29.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to an SQL injection exploitable by Subscriber+ role.	https://www.exploit-db.com/exploits/52248
CVE-2024-55889	phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue.	https://www.exploit-db.com/exploits/52235
CVE-2024-7815	A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-update-employee.php of the component Update Employee Page. The manipulation of the argument emp_fname /emp_lname /emp_nat_idno/emp_addr leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.	https://www.exploit-db.com/exploits/52159
CVE-2024-6039	A vulnerability, which was classified as critical, was found in Feng Office 3.11.1.2. Affected is an unknown function of the component Workspaces. The manipulation of the argument dim leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-268752.	https://www.exploit-db.com/exploits/52154
CVE-2024-6244	The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks	https://www.exploit-db.com/exploits/52153
CVE-2024-39304	ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQL statements directly into the database query due to inadequate sanitization of the EID parameter in in a GET request to `/GetText.php`. Version 5.9.2 patches the issue.	https://www.exploit-db.com/exploits/52152
CVE-2024-39143	A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content with HTML inside which acts as a stored XSS payload.	https://www.exploit-db.com/exploits/52150
CVE-2024-27348	RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Users are recommended to upgrade to version 1.3.0 with Java11 & enable the Auth system, which fixes the issue.	https://www.exploit-db.com/exploits/52149
CVE-2024-37732	Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file.	https://www.exploit-db.com/exploits/52147
CVE-2024-9458	The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	https://www.exploit-db.com/exploits/52133
CVE-2024-1234	The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	https://www.exploit-db.com/exploits/52126
CVE-2024-42831	A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary JavaScript code in the web browser of a user via injecting a crafted payload into the dialog parameter at wrapper_dialog.php.	https://www.exploit-db.com/exploits/52106
CVE-2024-8945	A vulnerability has been found in CodeCanyon RISE Ultimate Project Manager 3.7.0 and classified as critical. This vulnerability affects unknown code of the file /index.php/dashboard/save. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.	https://www.exploit-db.com/exploits/52100
CVE-2024-44000	Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a before 6.5.0.1.	https://www.exploit-db.com/exploits/52099
CVE-2024-48120	X2CRM v8.5 is vulnerable to a stored Cross-Site Scripting (XSS) in the "Opportunities" module. An attacker can inject malicious JavaScript code into the "Name" field when creating a list.	https://www.exploit-db.com/exploits/52098
CVE-2024-46626	OS4ED openSIS-Classic v9.1 was discovered to contain a SQL injection vulnerability via a crafted payload.	https://www.exploit-db.com/exploits/52080
CVE-2024-41819	Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbitrary web scripts via a crafted payload injected into the URL value of a link in the markdown content. This vulnerability is fixed in 0.13.1.	https://www.exploit-db.com/exploits/52078
CVE-2024-6886	Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0.	https://www.exploit-db.com/exploits/52077
CVE-2024-36840	SQL Injection vulnerability in Boelter Blue System Management v.1.3 allows a remote attacker to execute arbitrary code and obtain sensitive information via the id parameter to news_details.php and location_details.php; and the section parameter to services.php.	https://www.exploit-db.com/exploits/52052
CVE-2024-3378	A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login of the component Login Portal. The manipulation of the argument redirectUrl leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 10.2.0.160 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-259501 was assigned to this vulnerability.	https://www.exploit-db.com/exploits/52009
CVE-2024-24499	Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2024-1007. Reason: This candidate is a duplicate of CVE-2024-1007. Notes: All CVE users should reference CVE-2024-1007 instead of this candidate.	https://www.exploit-db.com/exploits/51950
CVE-2024-46278	Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.	https://www.exploit-db.com/exploits/52228
CVE-2024-25641	Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code on the web server. The vulnerability is located within the `import_package()` function defined into the `/lib/import.php` script. The function blindly trusts the filename and file content provided within the XML data, and writes such files into the Cacti base path (or even outside, since path traversal sequences are not filtered). This can be exploited to write or overwrite arbitrary files on the web server, leading to execution of arbitrary PHP code or other security impacts. Version 1.2.27 contains a patch for this issue.	https://www.exploit-db.com/exploits/52225
CVE-2024-51463	IBM i 7.3, 7.4, and 7.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.	https://www.exploit-db.com/exploits/52212
CVE-2024-41947	XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.	https://www.exploit-db.com/exploits/52209
CVE-2024-50672	A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. The vulnerability occurs due to insufficient validation of user input, which is used as a query in Mongoose's find() function. This makes it possible for attackers to perform a full takeover of the administrator account. Attackers can then use the newly gained administrative privileges to upload a custom plugin to perform remote code execution (RCE) on the server hosting the web application.	Adapt Authoring Tool 0.11.3 - Remote Command Execution (RCE) - Multiple webapps Exploit
CVE-2024-10924	The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).	https://www.exploit-db.com/exploits/52207
CVE-2024-52302	common-user-management is a robust Spring Boot application featuring user management services designed to control user access dynamically. There is a critical security vulnerability in the application endpoint /api/v1/customer/profile-picture. This endpoint allows file uploads without proper validation or restrictions, enabling attackers to upload malicious files that can lead to Remote Code Execution (RCE).	https://www.exploit-db.com/exploits/52206
CVE-2024-47605	silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website. This issue has been addressed in silverstripe/framework version 5.3.8 and users are advised to upgrade. There are no known workarounds for this vulnerability.	https://www.exploit-db.com/exploits/52199
CVE-2024-11954	A vulnerability classified as problematic was found in Pimcore 11.4.2. Affected by this vulnerability is an unknown functionality of the component Search Document. The manipulation leads to basic cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.	https://www.exploit-db.com/exploits/52194
CVE-2024-56898	Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that they aren't authorized to, which can be leveraged to escalate privileges, create, modify or delete accounts.	https://www.exploit-db.com/exploits/52189
CVE-2024-37383	Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.	https://www.exploit-db.com/exploits/52173
CVE-2024-35540	A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.	https://www.exploit-db.com/exploits/52162
CVE-2024-38944	An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 component.	https://www.exploit-db.com/exploits/52151
CVE-2024-2054	The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.	https://www.exploit-db.com/exploits/52146
CVE-2024-8856	The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.	https://www.exploit-db.com/exploits/52131
CVE-2024-48827	An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function.	https://www.exploit-db.com/exploits/52130
CVE-2024-5910	Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.	https://www.exploit-db.com/exploits/52129
CVE-2024-55963	An issue was discovered in Appsmith before 1.51. A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. This is due to incorrect access control checks, which should check for super user permissions on the incoming request.	https://www.exploit-db.com/exploits/52118
CVE-2024-4007	Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured.	https://www.exploit-db.com/exploits/52112
CVE-2024-6209	Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized.	https://www.exploit-db.com/exploits/52108
CVE-2024-6298	Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely.	https://www.exploit-db.com/exploits/52107
CVE-2024-4358	In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality via an authentication bypass vulnerability.	https://www.exploit-db.com/exploits/52103
CVE-2024-23692	Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.	https://www.exploit-db.com/exploits/52102
CVE-2024-4956	Path Traversal in Sonatype Nexus Repository 3 allows an unauthenticated attacker to read system files. Fixed in version 3.68.1.	https://www.exploit-db.com/exploits/52101
CVE-2024-44871	An arbitrary file upload vulnerability in the component /admin/index.php of moziloCMS v3.0 allows attackers to execute arbitrary code via uploading a crafted file.	https://www.exploit-db.com/exploits/52096
CVE-2024-31621	An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 component.	https://www.exploit-db.com/exploits/52001
CVE-2024-29410	No summary available for this CVE	https://www.exploit-db.com/exploits/51943

# CVE-2023

CVE	CVE Description	Reference
CVE-2023-27636	Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor.	https://www.exploit-db.com/exploits/52035
CVE-2023-48974	Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_input parameter.	https://www.exploit-db.com/exploits/51963
CVE-2023-46024	No summary available for this CVE	https://www.exploit-db.com/exploits/51914
CVE-2023-46022	No summary available for this CVE	https://www.exploit-db.com/exploits/51912
CVE-2023-38836	File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.	https://www.exploit-db.com/exploits/51741
CVE-2023-39362	Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. The `lib/snmp.php` file has a set of functions, with similar behavior, that accept in input some variables and place them into an `exec` call without a proper escape or validation. This issue has been addressed in version 1.2.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.	https://www.exploit-db.com/exploits/51740
CVE-2023-4708	A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been rated as critical. This issue affects some unknown processing of the file /collection/all of the component GET Parameter Handler. The manipulation of the argument tag leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-238571. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/51729
CVE-2023-4548	A vulnerability classified as critical has been found in SPA-Cart eCommerce CMS 1.9.0.3. This affects an unknown part of the file /search of the component GET Parameter Handler. The manipulation of the argument filter[brandid] leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-238059.	https://www.exploit-db.com/exploits/51714
CVE-2023-4407	A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument date1/date2 leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-237511.	https://www.exploit-db.com/exploits/51701
CVE-2023-4547	A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filter[brandid]/filter[price] leads to cross site scripting. The attack may be launched remotely. VDB-238058 is the identifier assigned to this vulnerability.	https://www.exploit-db.com/exploits/51713
CVE-2023-37569	This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system.Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on targeted system.	https://www.exploit-db.com/exploits/51673
CVE-2023-4174	A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. The identifier VDB-236209 was assigned to this vulnerability.	https://www.exploit-db.com/exploits/51671
CVE-2023-4173	A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6. Affected is an unknown function of the file /search/index. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236208.	https://www.exploit-db.com/exploits/51670
CVE-2023-39115	install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document.	https://www.exploit-db.com/exploits/51656
CVE-2023-4119	A vulnerability has been found in Academy LMS 6.0 and classified as problematic. This vulnerability affects unknown code of the file /academy/home/courses. The manipulation of the argument query/sort_by leads to cross site scripting. The attack can be initiated remotely. VDB-235966 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/51654
CVE-2023-4117	A vulnerability, which was classified as problematic, has been found in PHP Jabbers Rental Property Booking 2.0. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-235964. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/51653
CVE-2023-4116	A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-235963. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/51652
CVE-2023-4115	A vulnerability classified as problematic has been found in PHP Jabbers Cleaning Business 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument index leads to cross site scripting. It is possible to launch the attack remotely. VDB-235962 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/51651
CVE-2023-4114	A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-235961 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/51650
CVE-2023-4113	A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-235960. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/51649
CVE-2023-37979	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.	https://www.exploit-db.com/exploits/51644
CVE-2023-36306	A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components.	https://www.exploit-db.com/exploits/51643
CVE-2023-38501	copyparty is file server software. Prior to version 1.8.7, the application contains a reflected cross-site scripting via URL-parameter `?k304=...` and `?setck=...`. The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link. It is recommended to change the passwords of one's copyparty accounts, unless one have inspected one's logs and found no trace of attacks. Version 1.8.7 contains a patch for the issue.	https://www.exploit-db.com/exploits/51635
CVE-2023-2636	The AN_GradeBook WordPress plugin through 5.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber	https://www.exploit-db.com/exploits/51632
CVE-2023-3849	A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-235200. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.	https://www.exploit-db.com/exploits/51628
CVE-2023-36163	Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted script to the mc parameter of the URL.	https://www.exploit-db.com/exploits/51581
CVE-2023-33592	Lost and Found Information System v1.0 was discovered to contain a SQL injection vulnerability via the component /php-lfis/admin/?page=system_info/contact_information.	https://www.exploit-db.com/exploits/51570
CVE-2023-24078	Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/.	https://www.exploit-db.com/exploits/51550
CVE-2023-36346	POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.	https://www.exploit-db.com/exploits/51549
CVE-2023-27372	SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.	https://www.exploit-db.com/exploits/51536
CVE-2023-0297	Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.	https://www.exploit-db.com/exploits/51532
CVE-2023-23956	A user can supply malicious HTML and JavaScript code that will be executed in the client browser	https://www.exploit-db.com/exploits/51530
CVE-2023-33580	Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" field on Admin Profile page.	https://www.exploit-db.com/exploits/51528
CVE-2023-30868	Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <= 1.6.7 versions.	https://www.exploit-db.com/exploits/51507
CVE-2023-33584	Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the username and password fields during the login process, enabling an attacker to inject malicious SQL code.	https://www.exploit-db.com/exploits/51501
CVE-2023-0527	A vulnerability was found in PHPGurukul Online Security Guards Hiring System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file search-request.php. The manipulation of the argument searchdata with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219596.	https://www.exploit-db.com/exploits/51494
CVE-2023-33829	A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description text field.	https://www.exploit-db.com/exploits/51488
CVE-2023-34581	Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms/?page=services/view&id=2	https://www.exploit-db.com/exploits/51482
CVE-2023-25439	Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbitrary code via the description or content fields to the expenses, tasks, and customer details.	https://www.exploit-db.com/exploits/51480
CVE-2023-25440	Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.	https://www.exploit-db.com/exploits/51478
CVE-2023-31699	ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.	https://www.exploit-db.com/exploits/51477
CVE-2023-31703	Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter.	https://www.exploit-db.com/exploits/51467
CVE-2023-31702	SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.	https://www.exploit-db.com/exploits/51466
CVE-2023-30256	Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and email_create parameters in the AuthController.php file.	https://www.exploit-db.com/exploits/51465
CVE-2023-27350	This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.	https://www.exploit-db.com/exploits/51452
CVE-2023-1934	The PnPSCADA system, a product of SDG Technologies CC, is afflicted by a critical unauthenticated error-based PostgreSQL Injection vulnerability. Present within the hitlogcsv.jsp endpoint, this security flaw permits unauthenticated attackers to engage with the underlying database seamlessly and passively. Consequently, malicious actors could gain access to vital information, such as Industrial Control System (ICS) and OT data, alongside other sensitive records like SMS and SMS Logs. The unauthorized database access exposes compromised systems to potential manipulation or breach of essential infrastructure data, highlighting the severity of this vulnerability.	https://www.exploit-db.com/exploits/51448
CVE-2023-29809	SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a crafted script in the request.	https://www.exploit-db.com/exploits/51422
CVE-2023-29983	Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog tab in the admin panel.	https://www.exploit-db.com/exploits/51417
CVE-2023-31714	Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.	https://www.exploit-db.com/exploits/51383
CVE-2023-27179	GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.	https://www.exploit-db.com/exploits/51381
CVE-2023-26692	ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Management System (ZBBS) 4.14k is vulnerable to Cross Site Scripting (XSS).	https://www.exploit-db.com/exploits/51347
CVE-2023-22232	Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature. Exploitation of this issue does not require user interaction.	https://www.exploit-db.com/exploits/51327
CVE-2023-28343	OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.	https://www.exploit-db.com/exploits/51325
CVE-2023-24787	REJECT DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2023-24685. Reason: This record is a duplicate of CVE-2023-24685. Notes: All CVE users should reference CVE-2023-24685 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage.	https://www.exploit-db.com/exploits/51319
CVE-2023-24788	NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivery.php.	https://www.exploit-db.com/exploits/51318
CVE-2023-0902	A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.	https://www.exploit-db.com/exploits/51292
CVE-2023-0962	A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. This vulnerability affects unknown code of the file Master.php of the component GET Request Handler. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221632.	https://www.exploit-db.com/exploits/51291
CVE-2023-0961	A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_music_details.php of the component GET Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221631.	https://www.exploit-db.com/exploits/51290
CVE-2023-0938	A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file music_list.php of the component GET Request Handler. The manipulation of the argument cid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221553 was assigned to this vulnerability.	https://www.exploit-db.com/exploits/51288
CVE-2023-0902	A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.	https://www.exploit-db.com/exploits/51287
CVE-2023-0904	A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability.	https://www.exploit-db.com/exploits/51286
CVE-2023-0915	A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. Affected is an unknown function of the file /adms/admin/?page=user/manage_user. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221490 is the identifier assigned to this vulnerability.	https://www.exploit-db.com/exploits/51284
CVE-2023-0913	A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. This vulnerability affects unknown code of the file /adms/admin/?page=vehicles/sell_vehicle. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221482 is the identifier assigned to this vulnerability.	https://www.exploit-db.com/exploits/51283
CVE-2023-0912	A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. This affects an unknown part of the file /adms/admin/?page=vehicles/view_transaction. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221481 was assigned to this vulnerability.	https://www.exploit-db.com/exploits/51282
CVE-2023-23156	Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the pid parameter in the single-product page.	https://www.exploit-db.com/exploits/51272
CVE-2023-23286	Cross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via username field from the login form.	https://www.exploit-db.com/exploits/51264
CVE-2023-0214	A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be injected into the response when accessed through SWG.	https://www.exploit-db.com/exploits/51237
CVE-2023-23488	The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.	https://www.exploit-db.com/exploits/51235
CVE-2023-23163	Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter.	https://www.exploit-db.com/exploits/51216
CVE-2023-23162	Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at product.php.	https://www.exploit-db.com/exploits/51215
CVE-2023-23161	A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the artname parameter under ART TYPE option in the navigation bar.	https://www.exploit-db.com/exploits/51214
CVE-2023-0084	The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, which is the submissions page.	https://www.exploit-db.com/exploits/51204
CVE-2023-25289	Directory Traversal vulnerability in virtualreception Digital Receptie version win7sp1_rtm.101119-1850 6.1.7601.1.0.65792 in embedded web server, allows attacker to gain sensitive information via a crafted GET request.	https://www.exploit-db.com/exploits/51142
CVE-2023-24657	phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.	https://www.exploit-db.com/exploits/52176
CVE-2023-30258	Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.	https://www.exploit-db.com/exploits/52170
CVE-2023-2745	WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. This allows unauthenticated attackers to access and load arbitrary translation files. In cases where an attacker is able to upload a crafted translation file onto the site, such as via an upload form, this could be also used to perform a Cross-Site Scripting attack.	https://www.exploit-db.com/exploits/52274
CVE-2023-44088	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.	https://www.exploit-db.com/exploits/52157
CVE-2023-48292	The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed.	https://www.exploit-db.com/exploits/52105
CVE-2023-1545	SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.	https://www.exploit-db.com/exploits/52094
CVE-2023-6710	A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.	https://www.exploit-db.com/exploits/52010
CVE-2023-6019	A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023	https://www.exploit-db.com/exploits/51978
CVE-2023-4382	A vulnerability, which was classified as problematic, has been found in tdevs Hyip Rio 2.1. Affected by this issue is some unknown functionality of the file /user/settings of the component Profile Settings. The manipulation of the argument avatar leads to cross site scripting. The attack may be launched remotely. VDB-237314 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	Hyip Rio 2.1 - Arbitrary File Upload - PHP webapps Exploit
CVE-2023-4168	A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236184. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/51667
CVE-2023-4112	A vulnerability was found in PHP Jabbers Shuttle Booking Software 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-235959. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	https://www.exploit-db.com/exploits/51648
CVE-2023-3849	A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-235200. NOTE: We tried to contact the vendor early about the disclosure but the official mail address was not working properly.	https://www.exploit-db.com/exploits/51628
CVE-2023-34635	Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in the username field of the login page.	https://www.exploit-db.com/exploits/51610
CVE-2023-37629	Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to "add-pig.php."	https://www.exploit-db.com/exploits/51598
CVE-2023-37269	Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting (XSS) attack. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly. These two factors significantly limit the potential harm of this vulnerability. This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files. As a workaround, one may apply the patches manually.	https://www.exploit-db.com/exploits/51591
CVE-2023-36163	Cross Site Scripting vulnerability in IP-DOT BuildaGate v.BuildaGate5 allows a remote attacker to execute arbitrary code via a crafted script to the mc parameter of the URL.	https://www.exploit-db.com/exploits/51581
CVE-2023-36348	POS Codekop v2.0 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the filename parameter.	https://www.exploit-db.com/exploits/51551
CVE-2023-2779	The Social Share, Social Login and Social Comments WordPress plugin before 7.13.52 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.	https://www.exploit-db.com/exploits/51534
CVE-2023-3184	A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save. The manipulation of the argument firstname/middlename/lastname/username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231164.	https://www.exploit-db.com/exploits/51513
CVE-2023-3187	A vulnerability, which was classified as critical, has been found in PHPGurukul Teachers Record Management System 1.0. Affected by this issue is some unknown functionality of the file /changeimage.php of the component Profile Picture Handler. The manipulation of the argument newpic leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231176.	https://www.exploit-db.com/exploits/51512
CVE-2023-0455	Unrestricted Upload of File with Dangerous Type in GitHub repository unilogies/bumsys prior to v1.0.3-beta.	https://www.exploit-db.com/exploits/51492
CVE-2023-3219	The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.	https://www.exploit-db.com/exploits/51659
CVE-2023-29918	RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.	https://www.exploit-db.com/exploits/51622
CVE-2023-30198	Prestashop winbizpayment <= 1.0.2 is vulnerable to Incorrect Access Control via modules/winbizpayment/downloads/download.php.	https://www.exploit-db.com/exploits/51545
CVE-2023-5360	The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.	https://www.exploit-db.com/exploits/52127
CVE-2023-0159	The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.	https://www.exploit-db.com/exploits/52085
CVE-2023-4220	Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell.	https://www.exploit-db.com/exploits/52083
CVE-2023-40279	An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do.	https://www.exploit-db.com/exploits/51995
CVE-2023-39147	An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.	https://www.exploit-db.com/exploits/51639
CVE-2023-4634	The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.	https://www.exploit-db.com/exploits/51737

# CVE-2022

CVE	CVE Description	Reference
CVE-2022-31470	An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and retrieve mailbox content.	https://www.exploit-db.com/exploits/51722
CVE-2022-35919	MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies.	https://www.exploit-db.com/exploits/51734
CVE - 2022-4944	A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.50 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227000.	https://www.exploit-db.com/exploits/51388
CVE-2022-43939	Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.	https://www.exploit-db.com/exploits/51350
CVE-2022-43769	Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.	https://www.exploit-db.com/exploits/51350
CVE-2022-48177	X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.	https://www.exploit-db.com/exploits/51346
CVE-2022-25630	An authenticated user can embed malicious content with XSS into the admin group policy page.	https://www.exploit-db.com/exploits/51342
CVE-2022-40347	SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' parameters, allows attackers to execute arbitrary code and gain sensitive information.	https://www.exploit-db.com/exploits/51274
CVE-2022-40032	SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitrary code and gain sensitive information.	https://www.exploit-db.com/exploits/51273
CVE-2022-48110	CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).	https://www.exploit-db.com/exploits/51260
CVE-2022-28598	Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users.	https://www.exploit-db.com/exploits/51255
CVE-2022-46604	An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.	https://www.exploit-db.com/exploits/51251
CVE-2022-34128	The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.	https://www.exploit-db.com/exploits/51234
CVE-2022-31056	GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.	https://www.exploit-db.com/exploits/51233
CVE-2022-31161	Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for this issue.	https://www.exploit-db.com/exploits/51228
CVE-2022-31126	Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.	https://www.exploit-db.com/exploits/51227
CVE-2022-24637	Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.	https://www.exploit-db.com/exploits/51026
CVE-2022-2840	The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections	https://www.exploit-db.com/exploits/51024
CVE-2022-2941	The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible for authenticated attackers, with administrative privileges, to inject JavaScript code into the setting that will execute whenever a user accesses the injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.	https://www.exploit-db.com/exploits/51020
CVE-2022-36633	Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.	https://www.exploit-db.com/exploits/51019
CVE-2022-36267	In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.	https://www.exploit-db.com/exploits/51011
CVE-2022-1040	An authentication bypass vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v18.5 MR3 and older.	https://www.exploit-db.com/exploits/51006
CVE-2022-34140	A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.	https://www.exploit-db.com/exploits/51002
CVE-2022-20277	There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files on the filesystem, leak process memory, or potentially lead to remote code execution.	https://www.exploit-db.com/exploits/51000
CVE-2022-31325	There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.	https://www.exploit-db.com/exploits/50965
CVE-2022-31885	Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.	https://www.exploit-db.com/exploits/50956
CVE-2022-29296	A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.	https://www.exploit-db.com/exploits/50955
CVE-2022-26134	In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before 7.4.17, from 7.13.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and from 7.18.0 before 7.18.1.	https://www.exploit-db.com/exploits/50952
CVE-2022-29298	SolarView Compact ver.6.00 allows attackers to access sensitive files via directory traversal.	https://www.exploit-db.com/exploits/50950
CVE-2022-23626	m1k1o/blog is a lightweight self-hosted facebook-styled PHP blog. Errors from functions `imagecreatefrom` and `image` have not been checked properly. Although PHP issued warnings and the upload function returned `false`, the original file (that could contain a malicious payload) was kept on the disk. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.	https://www.exploit-db.com/exploits/50943
CVE-2022-0967	Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.	https://www.exploit-db.com/exploits/50941
CVE-2022-29303	SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.	https://www.exploit-db.com/exploits/50940
CVE-2022-29727	Survey Sparrow Enterprise Survey Software 2022 has a Stored cross-site scripting (XSS) vulnerability in the Signup parameter.	https://www.exploit-db.com/exploits/50937
CVE-2022-28080	Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.	https://www.exploit-db.com/exploits/50934
CVE-2022-28079	College Management System v1.0 was discovered to contain a SQL injection vulnerability via the course_code parameter.	https://www.exploit-db.com/exploits/50933
CVE-2022-27308	A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a project title.	https://www.exploit-db.com/exploits/50922
CVE-2022-27412	Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.	https://www.exploit-db.com/exploits/50920
CVE-2022-24707	Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection vulnerabilities existed in Time Tracker Puncher plugin in versions of anuko timetracker prior to 1.20.0.5642. This was happening because the Puncher plugin was reusing code from other places and was relying on an unsanitized date parameter in POST requests. Because the parameter was not checked, it was possible to craft POST requests with malicious SQL for Time Tracker database. This issue has been resolved in in version 1.20.0.5642. Users unable to upgrade are advised to add their own checks to input.	https://www.exploit-db.com/exploits/50915
CVE-2022-28213	When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server and in successful exploits of DoS.	https://www.exploit-db.com/exploits/50900
CVE-2022-1175	mproper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.	https://www.exploit-db.com/exploits/50889
CVE-2022-1104	The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed	https://www.exploit-db.com/exploits/50876
CVE-2022-1163	Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next.	https://www.exploit-db.com/exploits/50853
CVE-2022-0824	Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.	https://www.exploit-db.com/exploits/50809
CVE-2022-23366	HMS v1.0 was discovered to contain a SQL injection vulnerability via patientlogin.php.	https://www.exploit-db.com/exploits/50729
CVE-2022-24223	AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.	https://www.exploit-db.com/exploits/50727
CVE-2022-0448	The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.	https://www.exploit-db.com/exploits/50724
CVE-2022-0332	A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.	https://www.exploit-db.com/exploits/50700
CVE-2022-24263	Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.	https://www.exploit-db.com/exploits/50718
CVE-2022-23046	PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php	https://www.exploit-db.com/exploits/50684
CVE-2022-21661	WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.	https://www.exploit-db.com/exploits/50663
CVE-2022-22965	A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.	https://pentest-tools.com/blog/detect-exploit-spring4shell-cve-2022-22965
CVE-2022-42889	Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.	https://www.exploit-db.com/exploits/52261
CVE-2022-41358	A stored cross-site scripting (XSS) vulnerability in Garage Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the categoriesName parameter in createCategories.php.	https://www.exploit-db.com/exploits/52238
CVE-2022-37061	All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the root privileges.	https://www.exploit-db.com/exploits/52240
CVE-2022-4297	The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection	https://www.exploit-db.com/exploits/51560
CVE-2022-4407	Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9.	https://www.exploit-db.com/exploits/52226
CVE-2022-35914	/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.	https://www.exploit-db.com/exploits/52023
CVE-2022-4395	The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE.	https://www.exploit-db.com/exploits/51959
CVE-2022-4681	The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.	https://www.exploit-db.com/exploits/51871

# CVE-2021

CVE	CVE Description	Reference
CVE-2021-42751	A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node.	https://www.exploit-db.com/exploits/51004
CVE-2021-42750	A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.	https://www.exploit-db.com/exploits/51003
CVE-2021-43481	An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstage.php.	https://www.exploit-db.com/exploits/50893
CVE-2021-24499	The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.	https://www.exploit-db.com/exploits/51510
CVE-2021-21276	Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a request with specific cookie headers to the /setup/finish endpoint, they may be able to obtain admin privileges on the instance. This is caused by a loose comparison (==) in SetupController that is susceptible to attack. The project has been patched to ensure that a strict comparison (===) is used to verify the setup key, and that /setup/finish verifies that no users table exists before performing any migrations or provisioning any new accounts. This is fixed in version 2.3.0. Users can patch this vulnerability without upgrading by adding abort(404) to the very first line of finishSetup in SetupController.php.	https://www.exploit-db.com/exploits/51277
CVE-2021-36520	A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.	https://www.exploit-db.com/exploits/51253
CVE-2021-44790	A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and earlier.	https://www.exploit-db.com/exploits/51193
CVE-2021-4045	TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.	https://www.exploit-db.com/exploits/51017
CVE-2021-42751	A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the description of a rule node.	https://www.exploit-db.com/exploits/51004
CVE-2021-42750	A cross-site scripting (XSS) vulnerability in Rule Engine in ThingsBoard 3.3.1 allows remote attackers (with administrative access) to inject arbitrary JavaScript within the title of a rule node.	https://www.exploit-db.com/exploits/51003
CVE-2021-46424	Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request.	https://www.exploit-db.com/exploits/50935
CVE-2021-45428	TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files including HTML and CGI formats.	https://www.exploit-db.com/exploits/50931
CVE-2021-43481	An SQL Injection vulnerability exists in Webtareas 2.4p3 and earlier via the $uq HTTP POST parameter in editapprovalstage.php.	https://www.exploit-db.com/exploits/50893
CVE-2021-42136	A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to execute JavaScript code in the client's browser by storing said code as a Missing Data Code value. This can then be leveraged to execute a Cross-Site Request Forgery attack to escalate privileges to administrator.	https://www.exploit-db.com/exploits/50877
CVE-2021-46418	An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.	https://www.exploit-db.com/exploits/50862
CVE-2021-46416	Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.	https://www.exploit-db.com/exploits/50860
CVE-2021–42171	Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.	https://www.exploit-db.com/exploits/50850
CVE-2021-24405	The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users (such as subscriber) to change them. If users can't register, this can be done through CSRF. Furthermore, the cookie banner setting is not sanitised or validated before being output in all pages of the frontend and the backend settings one, leading to a Stored Cross-Site Scripting issue.	https://www.exploit-db.com/exploits/50849
CVE-2021-43701	CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby parameters.	https://www.exploit-db.com/exploits/50846
CVE-2021-26599	ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.	https://www.exploit-db.com/exploits/50839
CVE-2021-45010	A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution. A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials or with the CSRF vulnerability) with the "fullpath" parameter containing path traversal strings (../ and ..\) in order to escape the server's intended working directory and write malicious files onto any directory on the computer.	https://www.exploit-db.com/exploits/50828
CVE-2021-40964	A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution. A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials or with the CSRF vulnerability) with the "fullpath" parameter containing path traversal strings (../ and ..\) in order to escape the server's intended working directory and write malicious files onto any directory on the computer.	https://www.exploit-db.com/exploits/50828
CVE-2021-46387	ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.	https://www.exploit-db.com/exploits/50797
CVE-2021-25076	The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting	https://www.exploit-db.com/exploits/50772
CVE-2021-45092	Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.	https://www.exploit-db.com/exploits/50770
CVE-2021-43062	A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.	https://www.exploit-db.com/exploits/50759
CVE-2021-24901	The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.	https://www.exploit-db.com/exploits/50723
CVE-2021-24488	The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues	https://www.exploit-db.com/exploits/50705
CVE-2021-24300	The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue	https://www.exploit-db.com/exploits/50704
CVE-2021-24247	The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result, any registered user, such as subscriber, can leave an XSS payload in the plugin settings, which will be triggered by any user visiting them, and could allow for privilege escalation. The vendor decided to close the plugin.	https://www.exploit-db.com/exploits/50703
CVE-2021-24926	The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue	https://www.exploit-db.com/exploits/50697
CVE-2021-24786	The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue	https://www.exploit-db.com/exploits/50695
CVE-2021-37391	A user without privileges in Chamilo LMS 1.11.14 can send an invitation message to another user, e.g., the administrator, through main/social/search.php, main/inc/lib/social.lib.php and steal cookies or execute arbitrary code on the administration side via a stored XSS vulnerability via social network the send invitation feature.	https://www.exploit-db.com/exploits/50694
CVE-2021-24946	The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue	https://www.exploit-db.com/exploits/50687
CVE-2021-24862	The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection iss	https://www.exploit-db.com/exploits/50686
CVE-2021-24904	The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.	https://www.exploit-db.com/exploits/50685
CVE-2021-24563	The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly	https://www.exploit-db.com/exploits/50655
CVE-2021-44916	Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser.	https://www.exploit-db.com/exploits/50651
CVE-2021-45814	Nettmp NNT 5.1 is affected by a SQL injection vulnerability. An attacker can bypass authentication and access the panel with an administrative account.	https://www.exploit-db.com/exploits/50627
CVE-2021-45425	Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.	https://www.exploit-db.com/exploits/50626
CVE-2021-24750	The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 4.8 does not properly sanitise and escape the refUrl in the refDetails AJAX action, available to any authenticated user, which could allow users with a role as low as subscriber to perform SQL injection attacks	https://www.exploit-db.com/exploits/50619
CVE-2021-3817	wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command	https://www.exploit-db.com/exploits/50609
CVE-2021-43936	The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.	https://www.exploit-db.com/exploits/50589
CVE-2021-43798	Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, where is the plugin ID for any installed plugin. At no time has Grafana Cloud been vulnerable. Users are advised to upgrade to patched versions 8.0.7, 8.1.8, 8.2.7, or 8.3.1. The GitHub Security Advisory contains more information about vulnerable URL paths, mitigation, and the disclosure timeline.	https://www.exploit-db.com/exploits/50581
CVE-2021-39316	The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter.	https://www.exploit-db.com/exploits/50564
CVE-2021-44653	Online Magazine Management System 1.0 contains a SQL injection authentication bypass vulnerability. The Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to gain access as admin to the application.	https://www.exploit-db.com/exploits/50561
CVE-2021-44655	Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to get admin access on the application.	https://www.exploit-db.com/exploits/50560
CVE-2021-40577	A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 in the Add-Users page via the Name parameter.	https://www.exploit-db.com/exploits/50557
CVE-2021-43650	WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.	https://www.exploit-db.com/exploits/50542
CVE-2021-22205	An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.	https://www.exploit-db.com/exploits/50532
CVE-2021-35323	Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login.	https://www.exploit-db.com/exploits/50529
CVE-2021-42580	Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and authenticated file upload in (Master.php) file , we can craft these two vunlerablities to get unauthenticated remote command execution.	https://www.exploit-db.com/exploits/50526
CVE-2021-43140	SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login.	https://www.exploit-db.com/exploits/50522
CVE-2021-24664	The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.	https://www.exploit-db.com/exploits/50520
CVE-2021-42013	It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions. A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.	https://www.exploit-db.com/exploits/50512
CVE-2021-41773	It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions. A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.	https://www.exploit-db.com/exploits/50512
CVE-2021-43405	An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric).	https://www.exploit-db.com/exploits/50505
CVE-2021-42325	Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name.	https://www.exploit-db.com/exploits/50502
CVE-2021-29156	ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.	https://www.exploit-db.com/exploits/50480
CVE-2021-43338	Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-43339. Reason: This candidate is a duplicate of CVE-2021-43339. Notes: All CVE users should reference CVE-2021-43339 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage	https://www.exploit-db.com/exploits/50469
CVE-2021-43339	In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export functionality. For example, a new admin user could be created.	https://www.exploit-db.com/exploits/50468
CVE-2021-20837	Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type Premium 1.46 and earlier, and Movable Type Premium Advanced 1.46 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.	https://www.exploit-db.com/exploits/50464
CVE-2021-31682	The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.	https://www.exploit-db.com/exploits/50463
CVE-2021-42013	It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.	https://www.exploit-db.com/exploits/50446
CVE-2021-24444	The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue.	https://www.exploit-db.com/exploits/50442
CVE-2021-36260	A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.	https://www.exploit-db.com/exploits/50441
CVE-2021-20034	An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.	https://www.exploit-db.com/exploits/50430
CVE-2021-42566	myfactory.FMS before 7.1-912 allows XSS via the Error parameter. myfactory.FMS before 7.1-912 allows XSS via the UID parameter.	https://www.exploit-db.com/exploits/50428
CVE-2021-42565	myfactory.FMS before 7.1-912 allows XSS via the Error parameter. myfactory.FMS before 7.1-912 allows XSS via the UID parameter.	https://www.exploit-db.com/exploits/50428
CVE-2021-24719	The Enfold Enfold WordPress theme before 4.8.4 was vulnerable to Reflected Cross-Site Scripting (XSS). The vulnerability is present on Enfold versions previous than 4.8.4 which use Avia Page Builder.	https://www.exploit-db.com/exploits/50427
CVE-2021-41878	A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button.	https://www.exploit-db.com/exploits/50418
CVE-2021-42013	It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.	https://www.exploit-db.com/exploits/50406
CVE-2021-32172	Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.	https://www.exploit-db.com/exploits/50394
CVE-2021-42053	The Unicorn framework through 0.35.3 for Django allows XSS via component.name.	https://www.exploit-db.com/exploits/50393
CVE-2021-41773	A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.	https://www.exploit-db.com/exploits/50383
CVE-2021-41318	In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.	https://www.exploit-db.com/exploits/50366
CVE-2021-24286	The settings page of the Redirect 404 to parent WordPress plugin before 1.3.1 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue	https://www.exploit-db.com/exploits/50350
CVE-2021-24287	The settings page of the Select All Categories and Taxonomies, Change Checkbox to Radio Buttons WordPress plugin before 1.3.2 did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue	https://www.exploit-db.com/exploits/50349
CVE-2021-24275	The Popup by Supsystic WordPress plugin before 1.10.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue	https://www.exploit-db.com/exploits/50346
CVE-2021-24274	The Ultimate Maps by Supsystic WordPress plugin before 1.2.5 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue	https://www.exploit-db.com/exploits/50345
CVE-2021-24276	The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue	https://www.exploit-db.com/exploits/50344
CVE-2021-24610	The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings. The 'trp_sanitize_string' function only removes script tag with a regex, still allowing other HTML tags and attributes to execute javascript, which could lead to authenticated Stored Cross-Site Scripting issues.	https://www.exploit-db.com/exploits/50343
CVE-2021-24169	This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.	https://www.exploit-db.com/exploits/50324
CVE-2021-40868	In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to Reflected XSS.	https://www.exploit-db.com/exploits/50317
CVE-2021-29447	Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. This requires WordPress installation to be using PHP 8. Access to internal files is possible in a successful XXE attack. This has been patched in WordPress version 5.7.1, along with the older affected versions via a minor release. We strongly recommend you keep auto-updates enabled.	https://www.exploit-db.com/exploits/50304
CVE-2021-40651	OS4Ed OpenSIS Community 8.0 is vulnerable to a local file inclusion vulnerability in Modules.php (modname parameter), which can disclose arbitrary file from the server's filesystem as long as the application has access to the file.	https://www.exploit-db.com/exploits/50259
CVE-2021-26084	In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.	https://www.exploit-db.com/exploits/50243
CVE-2021-3441	A potential security vulnerability has been identified for the HP OfficeJet 7110 Wide Format ePrinter that enables Cross-Site Scripting (XSS).	https://www.exploit-db.com/exploits/50227
CVE-2021-36654	CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while updating the theme.	https://www.exploit-db.com/exploits/50179
CVE-2021-37593	PEEL Shopping version 9.4.0 allows remote SQL injection. A public user/guest (unauthenticated) can inject a malicious SQL query in order to affect the execution of predefined SQL commands. Upon a successful SQL injection attack, an attacker can read sensitive data from the database and possibly modify database data.	https://www.exploit-db.com/exploits/50142
CVE-2021-35464	ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier	https://www.exploit-db.com/exploits/50131
CVE-2021-42362	The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.	https://www.exploit-db.com/exploits/50129
CVE-2021-22911	A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.	https://www.exploit-db.com/exploits/50108
CVE-2021-24145	Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the request.	https://www.exploit-db.com/exploits/50082
CVE-2021-35956	Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.	https://www.exploit-db.com/exploits/50080
CVE-2021-26078	The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.	https://www.exploit-db.com/exploits/50068
CVE-2021-24383	The WP Google Maps WordPress plugin before 8.1.12 did not sanitise, validate of escape the Map Name when output in the Map List of the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue	https://www.exploit-db.com/exploits/50051
CVE-2021-32305	WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.	https://www.exploit-db.com/exploits/50042
CVE-2021-34370	Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states "there are configurable security flags and we are unable to reproduce them with the available information.	https://www.exploit-db.com/exploits/49990
CVE-2021–27673	Cross Site Scripting (XSS) in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "cID" parameter when creating a new HTML component.	https://www.exploit-db.com/exploits/49988
CVE-2021-33904	In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states "there are configurable security flags and we are unable to reproduce them with the available information.	https://www.exploit-db.com/exploits/49980
CVE-2021-29440	Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11	https://www.exploit-db.com/exploits/49961
CVE-2021-22911	A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.	https://www.exploit-db.com/exploits/49960
CVE-2021-27308	A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.	https://www.exploit-db.com/exploits/49945
CVE-2021-27520	A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.	https://www.exploit-db.com/exploits/49943
CVE-2021-27519	A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.	https://www.exploit-db.com/exploits/49942
CVE-2021-28420	A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter.	https://www.exploit-db.com/exploits/49935
CVE-2021-28418	A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter.	https://www.exploit-db.com/exploits/49932
CVE-2021-28417	A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter	https://www.exploit-db.com/exploits/49931
CVE-2021-24308	The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.	https://www.exploit-db.com/exploits/49912
CVE-2021-33570	Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.	https://www.exploit-db.com/exploits/49910
CVE-2021-24299	The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.	https://www.exploit-db.com/exploits/49903
CVE-2021-33561	A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html. A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.	https://www.exploit-db.com/exploits/49901
CVE-2021-33562	A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html. A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.	https://www.exploit-db.com/exploits/49901
CVE-2021-27828	SQL injection in In4Suite ERP 3.2.74.1370 allows attackers to modify or delete data, causing persistent changes to the application's content or behavior by using malicious SQL queries.	https://www.exploit-db.com/exploits/49884
CVE-2021-24245	The Stop Spammers WordPress plugin before 2021.9 did not escape user input when blocking requests (such as matching a spam word), outputting it in an attribute after sanitising it to remove HTML tags, which is not sufficient and lead to a reflected Cross-Site Scripting issue.	https://www.exploit-db.com/exploits/49880
CVE-2021-31933	A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads, and improper file-extension filtering for certain filenames (e.g., .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution.	https://www.exploit-db.com/exploits/49867
CVE-2021-28242	SQL Injection in the "evoadm.php" component of b2evolution v7.2.2-stable allows remote attackers to obtain sensitive database information by injecting SQL commands into the "cf_name" parameter when creating a new filter under the "Collections" tab.	https://www.exploit-db.com/exploits/49840
CVE-2021-27973	SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.	https://www.exploit-db.com/exploits/49818
CVE-2021-29460	Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like `<script>` tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that link in a browser where they are logged in to Kirby, the script will run and can for example trigger requests to Kirby's API with the permissions of the victim. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. Visitors without Panel access can only use this attack vector if your site allows SVG file uploads in frontend forms and you don't already sanitize uploaded SVG files. The problem has been patched in Kirby 3.5.4. Please update to this or a later version to fix the vulnerability. Frontend upload forms need to be patched separately depending on how they store the uploaded file(s). If you use `File::create()`, you are protected by updating to 3.5.4+. As a work around you can disable the upload of SVG files in your file blueprints	https://www.exploit-db.com/exploits/49808
CVE-2021-28419	The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases.	https://www.exploit-db.com/exploits/49804
CVE-2021-3318	attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.	https://www.exploit-db.com/exploits/49799
CVE-2021-28935	CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.	https://www.exploit-db.com/exploits/49793
CVE-2021-25680	The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version 10.8.1 was able to be confirmed during primary research. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched	https://www.exploit-db.com/exploits/49786
CVE-2021-25679	The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only version 10.8.1 was able to be confirmed during primary research. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched	https://www.exploit-db.com/exploits/49785
CVE-2021-30044	Cross Site Scripting (XSS) in Remote Clinic v2.0 via the First Name or Last Name field on staff/register.php.	https://www.exploit-db.com/exploits/49781
CVE-2021-30637	htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php.	https://www.exploit-db.com/exploits/49772
CVE-2021-29003	Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI.	https://www.exploit-db.com/exploits/49764
CVE-2021-30150	Composr 10.0.36 allows XSS in an XML script.	https://www.exploit-db.com/exploits/49749
CVE-2021-27946	SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).	https://www.exploit-db.com/exploits/49699
CVE-2021-27890 2021-27889	SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files. Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.	https://www.exploit-db.com/exploits/49696
CVE-2021-27695	Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters.	https://www.exploit-db.com/exploits/49649
CVE-2021-27065	Microsoft Exchange Server Remote Code Execution Vulnerability	https://www.exploit-db.com/exploits/49637
CVE-2021-26855	Microsoft Exchange Server Remote Code Execution Vulnerability	https://www.exploit-db.com/exploits/49637
CVE-2021-3355	A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.	https://www.exploit-db.com/exploits/49598
CVE-2021-27370	The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.	https://www.exploit-db.com/exploits/49582
CVE-2021–26723	Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.	https://www.exploit-db.com/exploits/49529
CVE-2021-3186	A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_multi allows remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter.	https://www.exploit-db.com/exploits/49478
CVE-2021-3294	CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user redirection to a malicious website	https://www.exploit-db.com/exploits/49469
CVE-2021-3298	Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page, aka the manageuser.php?action=edit address1 parameter	https://www.exploit-db.com/exploits/49468
CVE-2021-3129	Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.	https://www.exploit-db.com/exploits/49424
CVE-2021-25791	Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields.	https://www.exploit-db.com/exploits/49396
CVE-2021-3018	ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page.	https://www.exploit-db.com/exploits/49372
CVE-2021-3278	Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulnerability, an attacker can bypass the login page.	https://www.exploit-db.com/exploits/49163
CVE-2021-36393	In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.	https://www.exploit-db.com/exploits/51984
CVE-2021-44567	An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php.	https://www.exploit-db.com/exploits/52169
CVE-2021-25094	The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.	https://www.exploit-db.com/exploits/52260
CVE-2021-28976	Remote Code Execution vulnerability in GetSimpleCMS before 3.3.16 in admin/upload.php via phar filess.	https://www.exploit-db.com/exploits/52168

# CVE-2020

CVE	CVE Description	Reference
CVE-2020-35151	The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection.	https://www.exploit-db.com/exploits/49307
CVE-2020-20139	Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.	https://www.exploit-db.com/exploits/49305
CVE-2020-20142	Cross Site Scripting (XSS) vulnerability in the "To Remote CSV" component under "Open" Menu in Flexmonster Pivot Table & Charts 2.7.17.	https://www.exploit-db.com/exploits/49304
CVE-2020-20141	Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.	https://www.exploit-db.com/exploits/49303
CVE-2020-20140	Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17.	https://www.exploit-db.com/exploits/49302
CVE-2020-25494	Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook.	https://www.exploit-db.com/exploits/49301
CVE-2020-25495	A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section'.	https://www.exploit-db.com/exploits/49300
CVE-2020-35416	Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web script or HTML.	https://www.exploit-db.com/exploits/49281
CVE-2020-2230	Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.	https://www.exploit-db.com/exploits/49237
CVE-2020-2229	Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.	https://www.exploit-db.com/exploits/49232
CVE-2020-29477	Invision Community 4.5.4 is affected by cross-site scripting (XSS) in the Field Name field. This vulnerability can allow an attacker to inject the XSS payload in Field Name and each time any user will open that, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.	https://www.exploit-db.com/exploits/49188
CVE-2020-29469	WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie according to the crafted payload.	https://www.exploit-db.com/exploits/49164
CVE-2020-14073	XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can create a map, and then use the Map Designer Properties screen to insert JavaScript code. This can be exploited against any user with View Maps or Edit Maps access.	https://www.exploit-db.com/exploits/49156
CVE-2020-29395	The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.	https://www.exploit-db.com/exploits/49130
CVE-2020-35313	A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer.	https://www.exploit-db.com/exploits/49154
CVE-2020-10963	FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.	https://www.exploit-db.com/exploits/49112
CVE-2020-29470	OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.	https://www.exploit-db.com/exploits/49099
CVE-2020-29471	OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.	https://www.exploit-db.com/exploits/49098
CVE-2020-28092	PESCMS Team 2.3.2 has multiple reflected XSS via the id parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&status=0&id=,?g=Team&m=Task&a=my&status=1&id=,?g=Team&m=Task&a=my&status=10&id=	https://www.exploit-db.com/exploits/49072
CVE-2020-25820	BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.	https://www.exploit-db.com/exploits/49070
CVE-2020-29475	nopCommerce Store 4.30 is affected by cross-site scripting (XSS) in the Schedule tasks name field. This vulnerability can allow an attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.	https://www.exploit-db.com/exploits/49093
CVE-2020-7934	In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.	https://www.exploit-db.com/exploits/49091
CVE-2020-29233	WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload in the Page description and each time any user will visits the website, the XSS triggers and attacker can steal the cookie according to the crafted payload.	https://www.exploit-db.com/exploits/49085
CVE-2020-15478	The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors.	https://www.exploit-db.com/exploits/49044
CVE-2020-26218	touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0.	https://www.exploit-db.com/exploits/49040
CVE-2020-15255	In Anuko Time Tracker before verion 1.19.23.5325, due to not properly filtered user input a CSV export of a report could contain cells that are treated as formulas by spreadsheet software (for example, when a cell value starts with an equal sign). This is fixed in version 1.19.23.5325.	https://www.exploit-db.com/exploits/49027
CVE-2020-28249	Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.	https://www.exploit-db.com/exploits/49024
CVE-2020-27533	A Cross Site Scripting (XSS) issue was discovered in the search feature of DedeCMS v.5.8 that allows malicious users to inject code into web pages, and other users will be affected when viewing web pages.	https://www.exploit-db.com/exploits/48974
CVE-2020-14864	Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are affected are 5.5.0.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).	https://www.exploit-db.com/exploits/48964
CVE-2020-5791	Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.	https://www.exploit-db.com/exploits/48959
CVE-2020-25270	PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name, Guardian Relation, Guardian Contact no, Address, or City.	https://www.exploit-db.com/exploits/48905
CVE-2020-35241	FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie according to the crafted payload.	https://www.exploit-db.com/exploits/48826
CVE-2020-25762	An issue was discovered in SourceCodester Seat Reservation System 1.0. The file admin_class.php does not perform input validation on the username and password parameters. An attacker can send malicious input in the post request to /admin/ajax.php?action=login and bypass authentication, extract sensitive information etc.	https://www.exploit-db.com/exploits/48889
CVE-2020-9467	Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request because of the pwg.images.setInfo function.	https://www.exploit-db.com/exploits/48814
CVE-2020-13260	A vulnerability in the web-based management interface of RAD SecFlow-1v through 2020-05-21 could allow an authenticated attacker to upload a JavaScript file, with a stored XSS payload, that will remain stored in the system as an OVPN file in Configuration-Services-Security-OpenVPN-Config or as the static key file in Configuration-Services-Security-OpenVPN-Static Keys. This payload will execute each time a user opens an affected web page. This could be exploited in conjunction with CVE-2020-13259.	https://www.exploit-db.com/exploits/48807
CVE-2020-24609	TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie via crafted payload.	https://www.exploit-db.com/exploits/48785
CVE-2020-24223	Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters.	https://www.exploit-db.com/exploits/48777
CVE-2020-23835	A Reflected Cross-Site Scripting (XSS) vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 allows remote attackers to harvest keys pressed by an unauthenticated victim who clicks on a malicious URL and begins typing.	https://www.exploit-db.com/exploits/48813
CVE-2020-24609	TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie via crafted payload.	https://www.exploit-db.com/exploits/48753
CVE-2020-17506	Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.	https://www.exploit-db.com/exploits/48744
CVE-2020-15038	The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.	https://www.exploit-db.com/exploits/48724
CVE-2020-8163	The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.	https://www.exploit-db.com/exploits/48716
CVE-2020-5902	In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.	https://www.exploit-db.com/exploits/48711
CVE-2020-15364	The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.	https://www.exploit-db.com/exploits/48682
CVE-2020-15046	The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88.	https://www.exploit-db.com/exploits/48668
CVE-2020-15600	An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password.	https://www.exploit-db.com/exploits/48679
CVE-2020-14946	downloadFile.ashx in the Administrator section of the Surveillance module in Global RADAR BSA Radar 1.6.7234.24750 and earlier allows users to download transaction files. When downloading the files, a user is able to view local files on the web server by manipulating the FileName and FilePath parameters in the URL, or while using a proxy. This vulnerability could be used to view local sensitive files or configuration files.	https://www.exploit-db.com/exploits/48666
CVE-2020-3452	A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system. The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to ASA or FTD system files or underlying operating system (OS) files.	https://www.exploit-db.com/exploits/48722
CVE-2020-15046	The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88.	https://www.exploit-db.com/exploits/48652
CVE-2020-5902	In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.	https://www.exploit-db.com/exploits/48643
CVE-2020-15599	Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.	https://www.exploit-db.com/exploits/48626
CVE-2020-14943	The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting (XSS) via Update User Profile.	https://www.exploit-db.com/exploits/48619
CVE-2020-13228	An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter.	https://www.exploit-db.com/exploits/48582
CVE-2020-5192	PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not validating user input, and allow for the application's database and information to be fully compromised.	https://www.exploit-db.com/exploits/47840
CVE-2020-5191	PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities.	https://www.exploit-db.com/exploits/47841
CVE-2020-7991	dive Framework 2.0.8 has admin/config CSRF to change the Administrator password.	https://www.exploit-db.com/exploits/47966
CVE-2020-8512	In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter.	https://www.exploit-db.com/exploits/47988
CVE-2020-8839	Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.	https://www.exploit-db.com/exploits/48040
CVE-2020-8825	index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS.	https://www.exploit-db.com/exploits/48042
CVE-2020-10173	Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnostic pages, as demonstrated by shell metacharacters in the pingIpAddress parameter to ping.cgi.	https://www.exploit-db.com/exploits/48142
CVE-2020-6756	languageOptions.php in Rasilient PixelStor 5000 K:4.0.1580-20150629 (KDI Version) allows unauthenticated attackers to remotely execute code via the lang parameter.	https://www.exploit-db.com/exploits/47899
CVE-2020-8656	An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the username field to getApiKey in include/api_functions.php.	https://www.exploit-db.com/exploits/48025
CVE-2020-8947	unctions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224.	https://www.exploit-db.com/exploits/48064
CVE-2020-9374	On TP-Link TL-WR849N 0.9.1 4.16 devices, a remote command execution vulnerability in the diagnostics area can be exploited when an attacker sends specific shell metacharacters to the panel's traceroute feature.	https://www.exploit-db.com/exploits/48155
CVE-2020-8776	Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.	https://www.exploit-db.com/exploits/48162
CVE-2020-8777	Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.	https://www.exploit-db.com/exploits/48162
CVE-2020-8778	Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.	https://www.exploit-db.com/exploits/48162
CVE-2020-9371	Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.	https://www.exploit-db.com/exploits/48204
CVE-2020-9372	The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.	https://www.exploit-db.com/exploits/48204
CVE-2020-10221	lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter.	https://www.exploit-db.com/exploits/48207
CVE-2020-15468	Persian VIP Download Script 1.0 allows SQL Injection via the cart_edit.php active parameter.	https://www.exploit-db.com/exploits/48190
CVE-2020-8865	This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the params[template] parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10469.	https://www.exploit-db.com/exploits/48209
CVE-2020-8866	This vulnerability allows remote attackers to create arbitrary files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within add.php. The issue results from the lack of proper validation of user-supplied data, which can allow the upload of arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the www-data user. Was ZDI-CAN-10125.	https://www.exploit-db.com/exploits/48209
CVE-2020-10230	CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQL Injection via the /cwp_{SESSION_HASH}/admin/loader_ajax.php term parameter.	https://www.exploit-db.com/exploits/48212
CVE-2020-10387	Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence (../) via the GET parameter file.	https://www.exploit-db.com/exploits/48220
CVE-2020-10386	admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory.	https://www.exploit-db.com/exploits/48221
CVE-2020-11455	LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.	https://www.exploit-db.com/exploits/48297
CVE-2020-5726	The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.	https://www.exploit-db.com/exploits/48270
CVE-2020-11530	A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to get_script/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user.	https://www.exploit-db.com/exploits/48457
CVE-2020-13118	An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community.php via the parameter community.	https://www.exploit-db.com/exploits/48474
CVE-2020-3952	Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not correctly implement access controls.	https://www.exploit-db.com/exploits/48535
CVE-2020-13448	QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter.	https://www.exploit-db.com/exploits/48536
CVE-2020-12704	UliCMS before 2020.2 has PageController stored XSS.	https://www.exploit-db.com/exploits/48244
CVE-2020-10385	A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.5.9 for WordPress.	https://www.exploit-db.com/exploits/48245
CVE-2020-12707	An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements.	https://www.exploit-db.com/exploits/48250
CVE-2020-11456	LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).	https://www.exploit-db.com/exploits/48289
CVE-2020-11457	pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.	https://www.exploit-db.com/exploits/48300
CVE-2020-12706	Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php	https://www.exploit-db.com/exploits/48404
CVE-2020-11023	In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.	https://www.exploit-db.com/exploits/49767
CVE-2020-18662	SQL Injection vulnerability in gnuboard5 <=v5.3.2.8 via the table_prefix parameter in install_db.php.	https://www.exploit-db.com/exploits/52167
CVE-2020-5509	PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.	https://www.exploit-db.com/exploits/52243
CVE-2020-7656	jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.	https://www.exploit-db.com/exploits/52141

# CVE-2019

CVE	CVE Description	Reference
CVE-2019-19368	A Reflected Cross Site Scripting was discovered in the Login page of Rumpus FTP Web File Manager 8.2.9.1. An attacker can exploit it by sending a crafted link to end users and can execute arbitrary Javascripts	https://www.exploit-db.com/exploits/47789
CVE-2019-19731	Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).	https://www.exploit-db.com/exploits/47777
CVE-2019-19742	On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.	https://www.exploit-db.com/exploits/47776
CVE-2019-19576	class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.	https://www.exploit-db.com/exploits/47749
CVE-2019-5434	An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method. Such vulnerability could be used to perform various types of attacks, e.g. exploit serialize-related PHP vulnerabilities or PHP object injection. It is possible, although unconfirmed, that the vulnerability has been used by some attackers in order to gain access to some Revive Adserver instances and deliver malware through them to third party websites. This vulnerability was addressed in version 4.2.0.	https://www.exploit-db.com/exploits/47739
CVE-2019–14343	TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabulario_id=list URI.	https://www.exploit-db.com/exploits/47672
CVE-2019-18951	An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OI_Fw_V20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mnt_ping.cgi. NOTE: This may overlap CVE-2017–14127.	https://www.exploit-db.com/exploits/47659
CVE-2019-18396	An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OI_Fw_V20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mnt_ping.cgi. NOTE: This may overlap CVE-2017–14127.	https://www.exploit-db.com/exploits/47651
CVE-2019-18873	FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload will execute. This will allow for PHP files to be written to the web root, and for code to execute on the remote server. The problem is in admsession.php and admuser.php.	https://www.exploit-db.com/exploits/47650
CVE-2019-7666	Prima Systems FlexAir, Versions 2.3.38 and prior. The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password.	https://www.exploit-db.com/exploits/47644
CVE-2019-7276	Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.	https://www.exploit-db.com/exploits/47641
CVE-2019-7272	Optergy Proton/Enterprise devices allow Username Disclosure.	https://www.exploit-db.com/exploits/47640
CVE-2019-9189	Prima Systems FlexAir, Versions 2.4.9api3 and prior. The application allows the upload of arbitrary Python scripts when configuring the main central controller. These scripts can be immediately executed because of root code execution, not as a web server user, allowing an authenticated attacker to gain full system access.	https://www.exploit-db.com/exploits/47634
CVE-2019-7671	Prima Systems FlexAir, Versions 2.3.38 and prior. Parameters sent to scripts are not properly sanitized before being returned to the user, which may allow an attacker to execute arbitrary code in a user’s browser session in context of an affected site.	https://www.exploit-db.com/exploits/47633
CVE-2019-10848	Computrols CBAS 18.0.0 allows Username Enumeration.	https://www.exploit-db.com/exploits/47630
CVE-2019-7255	Linear eMerge E3-Series devices allow XSS.	https://www.exploit-db.com/exploits/47623
CVE-2019-7257	Linear eMerge E3-Series devices allow Unrestricted File Upload.	https://www.exploit-db.com/exploits/47622
CVE-2019-7256	Linear eMerge E3-Series devices allow Command Injections.	https://www.exploit-db.com/exploits/47619
CVE-2019-7254	Linear eMerge E3-Series devices allow File Inclusion.	https://www.exploit-db.com/exploits/47616
CVE-2019-10846	Computrols CBAS 18.0.0 allows Unauthenticated Reflected Cross-Site Scripting vulnerabilities in the login page and password reset page via the username GET parameter.	https://www.exploit-db.com/exploits/47614
CVE-2019-7670	Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component, which could allow attackers to execute commands directly on the operating system.	https://www.exploit-db.com/exploits/47612
CVE-2019-14347	Internal/Views/addUsers.php in Schben Adive 2.0.7 allows remote unprivileged users (editor or developer) to create an administrator account via admin/user/add, as demonstrated by a Python PoC script.	https://www.exploit-db.com/exploits/47600
CVE-2019-10475	A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.	https://www.exploit-db.com/exploits/47598
CVE-2019-16662	An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution.	https://www.exploit-db.com/exploits/47555
CVE-2019-11043	In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.	https://www.exploit-db.com/exploits/47553
CVE-2019-17220	Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.	https://www.exploit-db.com/exploits/47537
CVE-2019-17503	An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database information such as database version, table name, column name, etc.	https://www.exploit-db.com/exploits/47498
CVE-2019-6971	An issue was discovered on TP-Link TL-WR1043ND V2 devices. An attacker can send a cookie in an HTTP authentication packet to the router management web interface, and fully control the router without knowledge of the credentials.	https://www.exploit-db.com/exploits/47483
CVE-2019-17132	vBulletin through 5.5.4 mishandles custom avatars.	https://www.exploit-db.com/exploits/47475
CVE-2019-17225	Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.	https://www.exploit-db.com/exploits/47469
CVE-2019-12562	Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. The exploit could be used to perfom any action with admin privileges such as managing content, adding users, uploading backdoors to the server, etc. Successful exploitation occurs when an admin user visits a notification page with stored cross-site scripting.	https://www.exploit-db.com/exploits/47448
CVE-2019-16759	vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.	https://www.exploit-db.com/exploits/47447
CVE-2019-16902	In the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.	https://www.exploit-db.com/exploits/47443
CVE-2019-16692	phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used.	https://www.exploit-db.com/exploits/47438
CVE-2019-16759	vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.	https://www.exploit-db.com/exploits/47437
CVE-2019-16894	download.php in inoERP 4.15 allows SQL injection through insecure deserialization.	https://www.exploit-db.com/exploits/47426
CVE-2019-1262	A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'.	https://www.exploit-db.com/exploits/47417
CVE-2019-16679	Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.	https://www.exploit-db.com/exploits/47407
CVE-2019-16399	Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/system_advanced.php?lang=en and login with the default root password welc0me.	https://www.exploit-db.com/exploits/47399
CVE-2019-16173	LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,	https://www.exploit-db.com/exploits/47386
CVE-2019-16197	In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.	https://www.exploit-db.com/exploits/47384
CVE-2019-16118	Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/controllers/Options.php.	https://www.exploit-db.com/exploits/47373
CVE-2019-16117	Cross site scripting (XSS) in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via admin/models/Galleries.php.	https://www.exploit-db.com/exploits/47372
CVE-2019-16119	SQL injection in the photo-gallery (10Web Photo Gallery) plugin before 1.5.35 for WordPress exists via the admin/controllers/Albumsgalleries.php album_id parameter.	https://www.exploit-db.com/exploits/47371
CVE-2019-16065	A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and compromise the web server, expose database tables and values, and potentially execute system-based commands as the mysql user. This affects the search_pattern value of the manage_hosts_short.cgi script.	https://www.exploit-db.com/exploits/47365
CVE-2019-16072	An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ip_address variable within an snmp_browser action.	https://www.exploit-db.com/exploits/47364
CVE-2019-10677	Multiple Cross-Site Scripting (XSS) issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd (name), /wlsecrefresh.wl (wlWscCfgMethod, wl_wsc_reg).	https://www.exploit-db.com/exploits/47351
CVE-2019-15889	The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or search[publish_date] parameter.	https://www.exploit-db.com/exploits/47350
CVE-2019-13237	In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.	https://www.exploit-db.com/exploits/47340
CVE-2019-13236	In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.	https://www.exploit-db.com/exploits/47339
CVE-2019-13235	In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.	https://www.exploit-db.com/exploits/47338
CVE-2019-15081	OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.	https://www.exploit-db.com/exploits/47331
CVE-2019-1010124	WebAppick WooCommerce Product Feed 2.2.18 and earlier is affected by: Cross Site Scripting (XSS). The impact is: XSS to RCE via editing theme files in WordPress. The component is: admin/partials/woo-feed-manage-list.php:63. The attack vector is: Administrator must be logged in.	https://www.exploit-db.com/exploits/47327
CVE-2019-15811	In DomainMOD through 4.13, the parameter daterange in the file reporting/domains/cost-by-month.php has XSS.	https://www.exploit-db.com/exploits/47325
CVE-2019-15814	Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML.	https://www.exploit-db.com/exploits/47324
CVE-2019-15813	Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.	https://www.exploit-db.com/exploits/47323
CVE-2019-9083	SQLiteManager 1.20 and 1.24 allows SQL injection via the /sqlitemanager/main.php dbsel parameter. NOTE: This product is discontinued.	https://www.exploit-db.com/exploits/47310
CVE-2019-14470	cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter.	https://www.exploit-db.com/exploits/47304
CVE-2019-15501	Reflected cross site scripting (XSS) in L-Soft LISTSERV before 16.5-2018a exists via the /scripts/wa.exe OK parameter.	https://www.exploit-db.com/exploits/47302
CVE-2019-18935	Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357, or other means. Exploitation can result in remote code execution. (As of 2020.1.114, a default setting prevents the exploit. In 2019.3.1023, but not earlier versions, a non-default setting can prevent exploitation.)	https://www.exploit-db.com/exploits/47793
CVE-2019-11013	Nimble Streamer 3.0.2-2 through 3.5.4-9 has a ../ directory traversal vulnerability. Successful exploitation could allow an attacker to traverse the file system to access files or directories that are outside of the restricted directory on the remote server.	https://www.exploit-db.com/exploits/47301
CVE-2019-14430	plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.	https://www.exploit-db.com/exploits/47294
CVE-2019-15107	An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.	https://www.exploit-db.com/exploits/47293
CVE-2019-14974	SugarCRM Enterprise 9.0.0 allows mobile/error-not-supported-platform.html?desktop_url= XSS.	https://www.exploit-db.com/exploits/47247
CVE-2019-14931	An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data.	https://www.exploit-db.com/exploits/47235
CVE-2019-14750	An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.	https://www.exploit-db.com/exploits/47226
CVE-2019-14749	An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. CSV (aka Formula) injection exists in the export spreadsheets functionality. These spreadsheets are generated dynamically from unvalidated or unfiltered user input in the Name and Internal Notes fields in the Users tab, and the Issue Summary field in the tickets tab. This allows other agents to download data in a .csv file format or .xls file format. This is used as input for spreadsheet applications such as Excel and OpenOffice Calc, resulting in a situation where cells in the spreadsheets can contain input from an untrusted source. As a result, the end user who is accessing the exported spreadsheet can be affected.	https://www.exploit-db.com/exploits/47225
CVE-2019-14748	An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also, the output is not handled properly, causing persistent XSS that leads to cookie stealing or malicious actions. For example, a non-agent user can upload a .html file, and Content-Disposition will be set to inline instead of attachment.	https://www.exploit-db.com/exploits/47224
CVE-2019-14804	studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.	https://www.exploit-db.com/exploits/47221
CVE-2019-14312	Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI.	https://www.exploit-db.com/exploits/47214
CVE-2019-14696	Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter.	https://www.exploit-db.com/exploits/47212
CVE-2019-14348	The BearDev JoomSport plugin 3.3 for WordPress allows SQL injection to steal, modify, or delete database information via the joomsport_season/new-yorkers/?action=playerlist sid parameter.	https://www.exploit-db.com/exploits/47210
CVE-2019-14221	1CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation.	https://www.exploit-db.com/exploits/47206
CVE-2019-2861	Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Planning accessible data. CVSS 3.0 Base Score 4.2 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N).	https://www.exploit-db.com/exploits/47196
CVE-2019-10266	An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication.	https://www.exploit-db.com/exploits/47181
CVE-2019-10267	An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the configured user (e.g., Administrator).	https://www.exploit-db.com/exploits/47180
CVE-2019-10267	An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. It is possible to upload a file into any directory of the server. One can insert a JSP shell into the web server's directory and execute it. This leads to full access to the system, as the configured user (e.g., Administrator).	https://www.exploit-db.com/exploits/47179
CVE-2019-13977	index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&id=1, tg=notes&idx=Create, tg=admfaqs&idx=Add, or tg=admoc&idx=addoc&item=.	https://www.exploit-db.com/exploits/47159
CVE-2019-13029	Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser.	https://www.exploit-db.com/exploits/47146
CVE-2019-13359	In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.	https://www.exploit-db.com/exploits/47124
CVE-2019-13396	FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.	https://www.exploit-db.com/exploits/47121
CVE-2019-12991	Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).	https://www.exploit-db.com/exploits/47112
CVE-2019-10349	A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.	https://www.exploit-db.com/exploits/47111
CVE-2019-13597	_s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a new script with an editor. It is possible to execute commands on the server using the _execute() function.	https://www.exploit-db.com/exploits/47110
CVE-2019-13346	In MyT 1.5.1, the User[username] parameter has XSS.	https://www.exploit-db.com/exploits/47109
CVE-2019-13491	No summary available for this CVE	https://www.exploit-db.com/exploits/47107
CVE-2019-13493	In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.	https://www.exploit-db.com/exploits/47106
CVE-2019-13344	An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. The contains() function in wp_like_button.php did not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update settings, as demonstrated by the wp-admin/admin.php?page=facebook-like-button each_page_url or code_snippet parameter.	https://www.exploit-db.com/exploits/47078
CVE-2019-9701	DLP 15.5 MP1 and all prior versions may be susceptible to a cross-site scripting (XSS) vulnerability, a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.	https://www.exploit-db.com/exploits/47071
CVE-2019-13024	Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the vulnerable page www/include/configuration/configGenerate/xml/generateFiles.php (which passes the inserted value to the database to shell_exec without sanitizing it, allowing one to execute system arbitrary commands).	https://www.exploit-db.com/exploits/47069
CVE-2019-13063	Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page. This will result in file disclosure (i.e., being able to pull any file from the remote victim application). This can be used to steal and obtain sensitive config and other files. This can result in complete compromise of the application. The script parameter is vulnerable to directory traversal and both local and remote file inclusion.	https://www.exploit-db.com/exploits/47062
CVE-2019-0285	The .NET SDK WebForm Viewer in SAP Crystal Reports for Visual Studio (fixed in version 2010) discloses sensitive database information including credentials which can be misused by the attacker.	https://www.exploit-db.com/exploits/47061
CVE-2019-12276	A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. A patch for this issue was made on 2019-05-30 in GrandNode 4.40.	https://www.exploit-db.com/exploits/47027
CVE-2019-12801	out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name.	https://www.exploit-db.com/exploits/47024
CVE-2019-12745	out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting (XSS) via the name field.	https://www.exploit-db.com/exploits/47023
CVE-2019-12744	SeedDMS before 5.1.11 allows Remote Command Execution (RCE) because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940.	https://www.exploit-db.com/exploits/47022
CVE-2019-11354	The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.	https://www.exploit-db.com/exploits/47021
CVE-2019-3778	Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).	https://www.exploit-db.com/exploits/47000
CVE-2019-11080	Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.	https://www.exploit-db.com/exploits/46987
CVE-2019-6588	In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.	https://www.exploit-db.com/exploits/46983
CVE-2019-11398	Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon.	https://www.exploit-db.com/exploits/46977
CVE-2019-12543	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.	https://www.exploit-db.com/exploits/46966
CVE-2019-12542	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.	https://www.exploit-db.com/exploits/46965
CVE-2019-12541	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.	https://www.exploit-db.com/exploits/46964
CVE-2019-12538	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.	https://www.exploit-db.com/exploits/46963
CVE-2019-12593	IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal.	https://www.exploit-db.com/exploits/46959
CVE-2019-10866	In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function get_labels_parameters in the file form-maker/admin/models/Submissions_fm.php with a crafted value of the /models/Submissioc parameter.	https://www.exploit-db.com/exploits/46958
CVE-2019-12347	In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.	https://www.exploit-db.com/exploits/46936
CVE-2019-12314	Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.	https://www.exploit-db.com/exploits/46931
CVE-2019-12279	Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass (aka the reset password form). NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that can be done with the variable provided, and while the username value being passed does get used in a SQL query, it is passed through SQL escaping functions when creating the call. The vendor tried re-creating the issue with no luck	https://www.exploit-db.com/exploits/46910
CVE-2019-11369	An issue was discovered in Carel pCOWeb prior to B1.2.4. In /config/pw_changeusers.html the device stores cleartext passwords, which may allow sensitive information to be read by someone with access to the device.	https://www.exploit-db.com/exploits/46898
CVE-2019-11370	Stored XSS was discovered in Carel pCOWeb prior to B1.2.4, as demonstrated by the config/pw_snmp.html "System contact" field.	https://www.exploit-db.com/exploits/46897
CVE-2019-11368	Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.	https://www.exploit-db.com/exploits/46896
CVE-2019-12189	An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.	https://www.exploit-db.com/exploits/46895
CVE-2019-9881	The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled.	https://www.exploit-db.com/exploits/46886
CVE-2019-12195	TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload, the network name changed automatically and the internet connection was disconnected. All the users become disconnected from the internet.	https://www.exploit-db.com/exploits/46882
CVE-2019-12185	eLabFTW 1.8.5 is vulnerable to arbitrary file uploads via the /app/controllers/EntityController.php component. This may result in remote command execution. An attacker can use a user account to fully compromise the system using a POST request. This will allow for PHP files to be written to the web root, and for code to execute on the remote server.	https://www.exploit-db.com/exploits/46869
CVE-2019-11600	A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter. The attack can be performed unauthenticated if OpenProject is configured not to require authentication for API access.	https://www.exploit-db.com/exploits/46838
CVE-2019-7442	An XML external entity (XXE) vulnerability in the Password Vault Web Access (PVWA) of CyberArk Enterprise Password Vault <=10.7 allows remote attackers to read arbitrary files or potentially bypass authentication via a crafted DTD in the SAML authentication system.	https://www.exploit-db.com/exploits/46828
CVE-2019-10685	A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Heidelberg Prinect Archiver v2013 release 1.0.	https://www.exploit-db.com/exploits/46804
CVE-2019-9978	The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.	https://www.exploit-db.com/exploits/46794
CVE-2019-11504	Zotonic before version 0.47 has mod_admin XSS.	https://www.exploit-db.com/exploits/46788
CVE-2019-3929	The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.	https://www.exploit-db.com/exploits/46786
CVE-2019-11429	CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen.	https://www.exploit-db.com/exploits/46784
CVE-2019-2725	Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).	https://www.exploit-db.com/exploits/46780
CVE-2019-10678	Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options.	https://www.exploit-db.com/exploits/46773
CVE-2019-3799	Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.	https://www.exploit-db.com/exploits/46772
CVE-2019-11564	A cross-site scripting (XSS) vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index.php POST request.	https://www.exploit-db.com/exploits/46771
CVE-2019-0186	The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file	https://www.exploit-db.com/exploits/46759
CVE-2019-11537	In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file inclusion.	https://www.exploit-db.com/exploits/46753
CVE-2019-7438	cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter.	https://www.exploit-db.com/exploits/46751
CVE-2019-11398	Multiple cross-site scripting (XSS) vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon.	https://www.exploit-db.com/exploits/46741
CVE-2019-2588	Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).	https://www.exploit-db.com/exploits/46728
CVE-2019-10945	An issue was discovered in Joomla! before 3.9.5. The Media Manager component does not properly sanitize the folder parameter, allowing attackers to act outside the media manager root directory.	https://www.exploit-db.com/exploits/46710
CVE-2019-9955	On Zyxel ATP200, ATP500, ATP800, USG20-VPN, USG20W-VPN, USG40, USG40W, USG60, USG60W, USG110, USG210, USG310, USG1100, USG1900, USG2200-VPN, ZyWALL 110, ZyWALL 310, ZyWALL 1100 devices, the security firewall login page is vulnerable to Reflected XSS via the unsanitized 'mp_idx' parameter.	https://www.exploit-db.com/exploits/46706
CVE-2019-11193	The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.	https://www.exploit-db.com/exploits/46694
CVE-2019-11446	An issue was discovered in ATutor through 2.2.4. It allows the user to run commands on the server with the teacher user privilege. The Upload Files section in the File Manager field contains an arbitrary file upload vulnerability via upload.php. The $IllegalExtensions value only lists lowercase (and thus .phP is a bypass), and omits .shtml and .phtml.	https://www.exploit-db.com/exploits/46691
CVE-2019-11017	On D-Link DI-524 V2.06RU devices, multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm, /smap.htm, and /cgi-bin/smap, as demonstrated by the cgi-bin/smap RC parameter.	https://www.exploit-db.com/exploits/46687
CVE-2019-10893	CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.	https://www.exploit-db.com/exploits/46669
CVE-2019-10887	A reflected HTML injection vulnerability on Salicru SLC-20-cube3(5) devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmLog.csv?log= or /waitlog.cgi?name= or /chart.shtml?data= or /createlog.cgi?name= request.	https://www.exploit-db.com/exploits/46667
CVE-2019-9593	A reflected Cross-site scripting (XSS) vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.	https://www.exploit-db.com/exploits/46666
CVE-2019-10874	Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.	https://www.exploit-db.com/exploits/46664
CVE-2019-10008	Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privilege escalation because an established guest session is automatically converted into an established administrator session when the guest user enters the administrator username, with an arbitrary incorrect password, in an mc/ login attempt within a different browser tab.	https://www.exploit-db.com/exploits/46659
CVE-2019-9053	An issue was discovered in CMS Made Simple 2.2.8. It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.	https://www.exploit-db.com/exploits/46635
CVE-2019-7441	cgi-bin/webscr?cmd=_cart in the WooCommerce PayPal Checkout Payment Gateway plugin 1.6.8 for WordPress allows Parameter Tampering in an amount parameter (such as amount_1), as demonstrated by purchasing an item for lower than the intended price. NOTE: The plugin author states it is true that the amount can be manipulated in the PayPal payment flow. However, the amount is validated against the WooCommerce order total before completing the order, and if it doesn’t match then the order will be left in an “On Hold” state	https://www.exploit-db.com/exploits/46632
CVE-2019-10261	CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action.	https://www.exploit-db.com/exploits/46629
CVE-2019-6965	An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter.	https://www.exploit-db.com/exploits/46620
CVE-2019-10226	HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection mechanism.	https://www.exploit-db.com/exploits/46617
CVE-2019-8385	An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a \.. to port 6677. Additionally, this could allow for privilege escalation by dumping the affected machine's SAM and SYSTEM database files, as well as remote code execution.	https://www.exploit-db.com/exploits/46615
CVE-2019-10009	A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505. When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using a \..\..\ technique, arbitrary files can be loaded in the server response outside the root directory.	https://www.exploit-db.com/exploits/46611
CVE-2019-7400	Rukovoditel before 2.4.1 allows XSS.	https://www.exploit-db.com/exploits/46608
CVE-2019-6279	ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware W2001EN-00 have an Incorrect Access Control vulnerability via the cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password.	https://www.exploit-db.com/exploits/46580
CVE-2019-9650	An XSS issue was discovered in upcoming_events.php in the Upcoming Events plugin before 1.33 for MyBB via a crafted name for an event.	https://www.exploit-db.com/exploits/46558
CVE-2019-9647	Gila CMS 1.9.1 has XSS.	https://www.exploit-db.com/exploits/46557
CVE-2019-9834	The Netdata web application through 1.13.0 allows remote attackers to inject their own malicious HTML code into an imported snapshot, aka HTML Injection. Successful exploitation will allow attacker-supplied HTML to run in the context of the affected browser, potentially allowing the attacker to steal authentication credentials or to control how the site is rendered to the user. NOTE: the vendor disputes the risk because there is a clear warning next to the button for importing a snapshot	https://www.exploit-db.com/exploits/46545
CVE-2019-8953	The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.	https://www.exploit-db.com/exploits/46538
CVE-2019-9618	The GraceMedia Media Player plugin 1.0 for WordPress allows Local File Inclusion via the "cfg" parameter.	https://www.exploit-db.com/exploits/46537
CVE-2019-9556	FiberHome an5506-04-f RP2669 devices have XSS.	https://www.exploit-db.com/exploits/46498
CVE-2019-9554	In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.	https://www.exploit-db.com/exploits/46496
CVE-2019-9553	Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.	https://www.exploit-db.com/exploits/46495
CVE-2019-7751	A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral, formerly PTI Marketing, FusionPro VDP before 10.0 allows a remote attacker to list or enumerate sensitive contents of files. Furthermore, this could allow for privilege escalation by dumping the local machine's SAM and SYSTEM database files, and possibly remote code execution.	https://www.exploit-db.com/exploits/46494
CVE-2019-7385	An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U, HT803G-W, HT803G-1GE, and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below, The values of the newpass and confpass parameters in /bin/WebMGR are used in a system call in the firmware. Because there is no user input validation, this leads to authenticated code execution on the device.	https://www.exploit-db.com/exploits/46489
CVE-2019-9581	phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favicon.php PHP code, because Presenters/Admin/ManageThemePresenter.php does not ensure an image file extension.	https://www.exploit-db.com/exploits/46486
CVE-2019-9194	elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.	https://www.exploit-db.com/exploits/46481
CVE-2019-9184	SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the product_option[] parameter.	https://www.exploit-db.com/exploits/46467
CVE-2019-6340	Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)	https://www.exploit-db.com/exploits/46459
CVE-2019-9041	An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring.	https://www.exploit-db.com/exploits/46454
CVE-2019-1003000	A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.	https://www.exploit-db.com/exploits/46453
CVE-2019-6340	Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core RESTful Web Services (rest) module enabled and allows PATCH or POST requests, or the site has another web services module enabled, like JSON:API in Drupal 8, or Services or RESTful Web Services in Drupal 7. (Note: The Drupal 7 Services module itself does not require an update at this time, but you should apply other contributed updates associated with this advisory if Services is in use.)	https://www.exploit-db.com/exploits/46452
CVE-2019-3475	A local privilege escalation vulnerability in the famtd component of Micro Focus Filr 3.0 allows a local attacker authenticated as a low privilege user to escalate to root. This vulnerability affects all versions of Filr 3.x prior to Security Update 6.	https://www.exploit-db.com/exploits/46450
CVE-2019-8937	HotelDruid 2.3.0 has XSS affecting the nsextt, cambia1, mese_fine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizza_tabelle.php.	https://www.exploit-db.com/exploits/46429
CVE-2019-1003002	A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.	https://www.exploit-db.com/exploits/46427
CVE-2019-8929	An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file in these GET parameters: param and rtype.	https://www.exploit-db.com/exploits/46425
CVE-2019-8924	XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued.	https://www.exploit-db.com/exploits/46424
CVE-2019-8394	Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.	https://www.exploit-db.com/exploits/46413
CVE-2019-8390	qdPM 9.1 suffers from Cross-site Scripting (XSS) in the search[keywords] parameter.	https://www.exploit-db.com/exploits/46399
CVE-2019-8391	qdPM 9.1 suffers from Cross-site Scripting (XSS) via configuration?type=[XSS] parameter.	https://www.exploit-db.com/exploits/46398
CVE-2019-8341	An issue was discovered in Jinja2 2.10. The from_string function is prone to Server Side Template Injection (SSTI) where it takes the "source" parameter as a template object, renders it, and then returns it. The attacker can exploit it with {{INJECTION COMMANDS}} in a URI. NOTE: The maintainer and multiple third parties believe that this vulnerability isn't valid because users shouldn't use untrusted templates without sandboxing	https://www.exploit-db.com/exploits/46386
CVE-2019-7541	Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.	https://www.exploit-db.com/exploits/46366
CVE-2019-6714	An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility, which is currently allowed. This results in remote code execution for an authenticated user.	https://www.exploit-db.com/exploits/46353
CVE-2019-7646	CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the "Package Name" field via the add_package module parameter.	https://www.exploit-db.com/exploits/46349
CVE-2019-6979	An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_logs.php useragent field.	https://www.exploit-db.com/exploits/46273
CVE-2019-1642	A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.	https://www.exploit-db.com/exploits/46263
CVE-2019-1653	A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. The vulnerability is due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and requesting specific URLs. A successful exploit could allow the attacker to download the router configuration or detailed diagnostic information. Cisco has released firmware updates that address this vulnerability.	https://www.exploit-db.com/exploits/46262
CVE-2019-6804	An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.	https://www.exploit-db.com/exploits/46251
CVE-2019-1652	A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious HTTP POST requests to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux shell as root. Cisco has released firmware updates that address this vulnerability.	https://www.exploit-db.com/exploits/46243
CVE-2019-6263	An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.	https://www.exploit-db.com/exploits/46200
CVE-2019-2413	Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data as well as unauthorized read access to a subset of Oracle Reports Developer accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).	https://www.exploit-db.com/exploits/46187
CVE-2019-6441	An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset functionality of the router doesn't have backend validation for the current password and doesn't require any type of authentication. By making a POST request to the apply.cgi file of the router, the attacker can change the admin username and password of the router.	https://www.exploit-db.com/exploits/46180
CVE-2019-6275	Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code.	https://www.exploit-db.com/exploits/46179
CVE-2019-5722	An issue was discovered in portier vision 4.4.4.2 and 4.4.4.6. Due to a lack of user input validation in parameter handling, it has various SQL injections, including on the login form, and on the search form for a key ring number.	https://www.exploit-db.com/exploits/46163
CVE-2019-5893	Nelson Open Source ERP v6.3.1 allows SQL Injection via the db/utils/query/data.xml query parameter.	https://www.exploit-db.com/exploits/46118
CVE-2019-9622	eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by reading the user-data/save/backup.sql file.	https://www.exploit-db.com/exploits/46109
CVE-2019-3501	The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile.	https://www.exploit-db.com/exploits/46080
CVE-2019-5009	Vtiger CRM 7.1.0 before Hotfix2 allows uploading files with the extension "php3" in the logo upload field, if the uploaded file is in PNG format and has a size of 150x40. One can put PHP code into the image; PHP code can be executed using "<? ?>" tags, as demonstrated by a CompanyDetailsSave action. This bypasses the bad-file-extensions protection mechanism. It is related to actions/CompanyDetailsSave.php, actions/UpdateCompanyLogo.php, and models/CompanyDetails.php.	https://www.exploit-db.com/exploits/46065
CVE-2019-11358	jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.	https://github.com/cve-sandbox/jquery/blob/main/CVE-2019-11358/index.html
CVE-2019-19245	NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used.	https://www.exploit-db.com/exploits/52192
CVE-2019-10652	An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature.	https://www.exploit-db.com/exploits/52165
CVE-2019-15949	Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.	https://www.exploit-db.com/exploits/52138

# CVE-2018

CVE	CVE Description	Reference
CVE-2018-1000811	bludit version 3.0.0 contains a Unrestricted Upload of File with Dangerous Type vulnerability in Content Upload in Pages Editor that can result in Remote Command Execution. This attack appear to be exploitable via malicious user have to upload a crafted payload containing PHP code.	https://www.exploit-db.com/exploits/46060
CVE-2018-20418	index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab.	https://www.exploit-db.com/exploits/46054
CVE-2018-1821	IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150170.	https://www.exploit-db.com/exploits/46017
CVE-2018-13045	SQL injection vulnerability in the "Bazar" page in Yeswiki Cercopitheque 2018-06-19-1 and earlier allows attackers to execute arbitrary SQL commands via the "id" parameter.	https://www.exploit-db.com/exploits/46015
CVE-2018-19933	Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.	https://www.exploit-db.com/exploits/46014
CVE-2018-19829	Artica Integria IMS 5.0.83 has CSRF in godmode/usuarios/lista_usuarios, resulting in the ability to delete an arbitrary user when the ID number is known.	https://www.exploit-db.com/exploits/46013
CVE-2018-19828	Artica Integria IMS 5.0.83 has XSS via the search_string parameter.	https://www.exploit-db.com/exploits/46012
CVE-2018-15535	/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal.	https://www.exploit-db.com/exploits/45271
CVE-2018-15877	The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request.	https://www.exploit-db.com/exploits/45274
CVE-2018-15745	Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.	https://www.exploit-db.com/exploits/45296
CVE-2018-16133	Cybrotech CyBroHttpServer 1.0.3 allows Directory Traversal via a ../ in the URI.	https://www.exploit-db.com/exploits/45303
CVE-2018-16134	Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.	https://www.exploit-db.com/exploits/45309
CVE-2018-15844	An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit.	https://www.exploit-db.com/exploits/45314
CVE-2018-14497	Tenda D152 ADSL routers allow XSS via a crafted SSID.	https://www.exploit-db.com/exploits/45336
CVE-2018-15917	Persistent cross-site scripting (XSS) issues in Jorani 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the language parameter to session/language.	https://www.exploit-db.com/exploits/45338
CVE-2018-15918	An issue was discovered in Jorani 0.6.5. SQL Injection (error-based) allows a user of the application without permissions to read and modify sensitive information from the database used by the application via the startdate or enddate parameter to leaves/validate.	https://www.exploit-db.com/exploits/45340
CVE-2018-16059	Endress+Hauser WirelessHART Fieldgate SWG70 3.x devices allow Directory Traversal via the fcgi-bin/wgsetcgi filename parameter.	https://www.exploit-db.com/exploits/45342
CVE-2018-10763	Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.	https://www.exploit-db.com/exploits/45386
CVE-2018-1756	IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, information in the back-end database. IBM X-Force ID: 148599.	https://www.exploit-db.com/exploits/45392
CVE-2018-1306	The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.	https://www.exploit-db.com/exploits/45396
CVE-2018-17254	The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter.	https://www.exploit-db.com/exploits/45423
CVE-2018-1002000	There is blind SQL injection in WordPress Arigato Autoresponder and Newsletter v2.5.1.8 These vulnerabilities require administrative privileges to exploit. There is an exploitable blind SQL injection vulnerability via the del_ids variable by POST request.	https://www.exploit-db.com/exploits/45434
CVE-2018-1002001	There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.	https://www.exploit-db.com/exploits/45434
CVE-2018-1002002	There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.	https://www.exploit-db.com/exploits/45434
CVE-2018-1002003	There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.	https://www.exploit-db.com/exploits/45434
CVE-2018-1002004	There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit.	https://www.exploit-db.com/exploits/45434
CVE-2018-1002005	These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:43: via the filter_signup_date parameter.	https://www.exploit-db.com/exploits/45434
CVE-2018-1002006	These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes	https://www.exploit-db.com/exploits/45434
CVE-2018-1002007	There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id.	https://www.exploit-db.com/exploits/45434
CVE-2018-1002008	There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in list-user.html.php:4: via GET request offset variable.	https://www.exploit-db.com/exploits/45434
CVE-2018-1002009	There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email variable.	https://www.exploit-db.com/exploits/45434
CVE-2018-16736	In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).	https://www.exploit-db.com/exploits/45437
CVE-2018-16283	The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.	https://www.exploit-db.com/exploits/45438
CVE-2018-16299	The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.	https://www.exploit-db.com/exploits/45439
CVE-2018-17255	Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2020-14014. Reason: This candidate is a reservation duplicate of CVE-2020-14014. Notes: All CVE users should reference CVE-2020-14014 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage	https://www.exploit-db.com/exploits/45445
CVE-2018-16288	LG SuperSign CMS allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs.	https://www.exploit-db.com/exploits/45440
CVE-2018-17173	LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.	https://www.exploit-db.com/exploits/45448
CVE-2018-17128	A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.	https://www.exploit-db.com/exploits/45449
CVE-2018-17391	SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter.	https://www.exploit-db.com/exploits/45463
CVE-2018-17379	SQL Injection exists in the Raffle Factory 3.5.2 component for Joomla! via the filter_order_Dir or filter_order parameter.	https://www.exploit-db.com/exploits/45464
CVE-2018-2791	Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).	https://www.exploit-db.com/exploits/44752
CVE-2018-11415	SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: the vendor has reportedly indicated that there will not be any further releases of this product.	https://www.exploit-db.com/exploits/44755
CVE-2018-7312	SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter.	https://www.exploit-db.com/exploits/44162
CVE-2018-7318	SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.	https://www.exploit-db.com/exploits/44163
CVE-2018-6222	Arbitrary logs location in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to change location of log files and be manipulated to execute arbitrary commands and attain command execution on a vulnerable system.	https://www.exploit-db.com/exploits/44166
CVE-2018-6223	A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate the registration process of the product to reset configuration parameters.	https://www.exploit-db.com/exploits/44166
CVE-2018-6225	An XML external entity injection (XXE) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an authenticated user to expose a normally protected configuration script.	https://www.exploit-db.com/exploits/44166
CVE-2018-6226	Reflected cross-site scripting (XSS) vulnerabilities in two Trend Micro Email Encryption Gateway 5.5 configuration files could allow an attacker to inject client-side scripts into vulnerable systems.	https://www.exploit-db.com/exploits/44166
CVE-2018-6227	A stored cross-site scripting (XSS) vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject client-side scripts into vulnerable systems.	https://www.exploit-db.com/exploits/44166
CVE-2018-6228	A SQL injection vulnerability in a Trend Micro Email Encryption Gateway 5.5 policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system.	https://www.exploit-db.com/exploits/44166
CVE-2018-6229	A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system.	https://www.exploit-db.com/exploits/44166
CVE-2018-7600	Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations.	https://www.exploit-db.com/exploits/44449
CVE-2018-6230	A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 search configuration script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system.	https://www.exploit-db.com/exploits/44166
CVE-2018-7477	SQL Injection exists in PHP Scripts Mall School Management Script 3.0.4 via the Username and Password fields to parents/Parent_module/parent_login.php.	https://www.exploit-db.com/exploits/44191
CVE-2018-7448	Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure.	https://www.exploit-db.com/exploits/44192
CVE-2018-6193	A Cross-Site Scripting (XSS) vulnerability was found in Routers2 2.24, affecting the 'rtr' GET parameter in a page=graph action to cgi-bin/routers2.pl.	https://www.exploit-db.com/exploits/44216
CVE-2018-6936	Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.	https://www.exploit-db.com/exploits/44219
CVE-2018-7490	uWSGI before 2.0.17 mishandles a DOCUMENT_ROOT check during use of the --php-docroot option, allowing directory traversal.	https://www.exploit-db.com/exploits/44223
CVE-2018-7474	An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php.	https://www.exploit-db.com/exploits/44277
CVE-2018-7703	Cross-site scripting (XSS) vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote attackers to inject arbitrary web script or HTML via the mailboxid parameter to secmail/getmessage.exe.	https://www.exploit-db.com/exploits/44285
CVE-2018-7705	Directory traversal vulnerability in SecurEnvoy SecurMail before 9.2.501 allows remote authenticated users to read e-mail messages to arbitrary recipients via a .. (dot dot) in the filename parameter to secupload2/upload.aspx.	https://www.exploit-db.com/exploits/44285
CVE-2018-7701	Multiple cross-site request forgery (CSRF) vulnerabilities in SecurEnvoy SecurMail before 9.2.501 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) delete e-mail messages via a delete action in a request to secmail/getmessage.exe or (2) spoof arbitrary users and reply to their messages via a request to secserver/securectrl.exe.	https://www.exploit-db.com/exploits/44285
CVE-2018-7538	SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 allows attackers to execute arbitrary SQL commands.	https://www.exploit-db.com/exploits/44286
CVE-2018-7543	Cross-site scripting (XSS) vulnerability in installer/build/view.step4.php of the SnapCreek Duplicator plugin 1.2.32 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the json parameter.	https://www.exploit-db.com/exploits/44288
CVE-2018-8772	Coship RT3052 4.0.0.48 devices allow XSS via a crafted SSID field on the "Wireless Setting - Basic" screen.	https://www.exploit-db.com/exploits/44320
CVE-2018-7422	A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.	https://www.exploit-db.com/exploits/44340
CVE-2018-7171	Directory traversal vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to share the contents of arbitrary directories via a .. (dot dot) in the contentbase parameter to rpc/set_all.	https://www.exploit-db.com/exploits/44350
CVE-2018-7203	Cross-site scripting (XSS) vulnerability in Twonky Server 7.0.11 through 8.5 allows remote attackers to inject arbitrary web script or HTML via the friendlyname parameter to rpc/set_all.	https://www.exploit-db.com/exploits/44351
CVE-2018-0878	Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to how XML External Entities (XXE) are processed, aka "Windows Remote Assistance Information Disclosure Vulnerability".	https://www.exploit-db.com/exploits/44352
CVE-2018-8903	Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.	https://www.exploit-db.com/exploits/44354
CVE-2018-8979	Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.	https://www.exploit-db.com/exploits/44360
CVE-2018-9034	Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the tab GET parameter.	https://www.exploit-db.com/exploits/44366
CVE-2018-9035	CSV Injection vulnerability in ExportToCsvUtf8.php of the Contact Form 7 to Database Extension plugin 2.10.32 for WordPress allows remote attackers to inject spreadsheet formulas into CSV files via the contact form.	https://www.exploit-db.com/exploits/44367
CVE-2018-7297	Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on the device. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.	https://www.exploit-db.com/exploits/44368
CVE-2018-9107	CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcyMailing extension before 5.9.6 for Joomla! via a value that is mishandled in a CSV export.	https://www.exploit-db.com/exploits/44369
CVE-2018-9106	CSV Injection (aka Excel Macro Injection or Formula Injection) exists in the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla! via a value that is mishandled in a CSV export.	https://www.exploit-db.com/exploits/44370
CVE-2018-5708	An issue was discovered on D-Link DIR-601 B1 2.02NA devices. Being on the same local network as, but being unauthenticated to, the administrator's panel, a user can obtain the admin username and cleartext password in the response (specifically, the configuration file restore_default), which is displayed in XML.	https://www.exploit-db.com/exploits/44388
CVE-2018-8815	Cross-site scripting (XSS) vulnerability in the gallery function in Alkacon OpenCMS 10.5.3 allows remote attackers to inject arbitrary web script or HTML via a malicious SVG image.	https://www.exploit-db.com/exploits/44392
CVE-2018-9183	The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.	https://www.exploit-db.com/exploits/44401
CVE-2018-7653	In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter.	https://www.exploit-db.com/exploits/44405
CVE-2018-7736	In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability	https://www.exploit-db.com/exploits/44406
CVE-2018-9173	Cross-site scripting (XSS) vulnerability in admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13 allows remote attackers to inject arbitrary web script or HTML, as demonstrated by the movieName parameter.	https://www.exploit-db.com/exploits/44408
CVE-2018-8729	Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.	https://www.exploit-db.com/exploits/44409
CVE-2018-7746	An issue was discovered in Western Bridge Cobub Razor 0.7.2. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a crafted channel name, stored XSS is triggered during a later /index.php?/manage/channel request by an admin.	https://www.exploit-db.com/exploits/44416
CVE-2018-9238	proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.	https://www.exploit-db.com/exploits/44424
CVE-2018-9235	iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query parameter to search.php.	https://www.exploit-db.com/exploits/44434
CVE-2018-9236	iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.	https://www.exploit-db.com/exploits/44436
CVE-2018-9237	iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.	https://www.exploit-db.com/exploits/44436
CVE-2018-8729	Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped.	https://www.exploit-db.com/exploits/44437
CVE-2018-1217	Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. The LDLS credentials are used to connect to Dell EMC Online Support. If the LDLS configuration was changed to an invalid configuration, then Avamar Installation Manager may not be able to connect to Dell EMC Online Support web site successfully. The remote unauthenticated attacker can also read and use the credentials to login to Dell EMC Online Support, impersonating the AVI service actions using those credentials.	https://www.exploit-db.com/exploits/44441
CVE-2018-9172	The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.	https://www.exploit-db.com/exploits/44443
CVE-2018-9844	The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes, leading to XSS.	https://www.exploit-db.com/exploits/44444
CVE-2018-10063	The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that is mishandled when exporting a Leads file.	https://www.exploit-db.com/exploits/44447
CVE-2018-8057	A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channel_name or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php.	https://www.exploit-db.com/exploits/44454
CVE-2018-9857	PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the "View Search By Id" screen).	https://www.exploit-db.com/exploits/44486
CVE-2018-8831	A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.	https://www.exploit-db.com/exploits/44487
CVE-2018-7747	Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email transaction log, or (3) an imported form.	https://www.exploit-db.com/exploits/44489
CVE-2018-10077	XML external entity (XXE) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to read arbitrary files via crafted XML data.	https://www.exploit-db.com/exploits/44493
CVE-2018-10078	Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a server description.	https://www.exploit-db.com/exploits/44493
CVE-2018-3811	SQL Injection vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to execute SQL queries in the context of the web server. The saveGoogleAdWords() function in smartgooglecode.php did not use prepared statements and did not sanitize the $_POST["oId"] variable before passing it as input into the SQL query.	https://www.exploit-db.com/exploits/43420
CVE-2018-5315	The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection via the event_id parameter to event.php.	https://www.exploit-db.com/exploits/43479
CVE-2018-5263	The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.	https://www.exploit-db.com/exploits/43488
CVE-2018-5370	BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI.	https://www.exploit-db.com/exploits/43535
CVE-2018-5479	FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admin(s). By sending users an infected URL, code will be executed.	https://www.exploit-db.com/exploits/43567
CVE-2018-5688	ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component.	https://www.exploit-db.com/exploits/43595
CVE-2018-5705	Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to the /search URI). Since there is an user/admin login interface, it's possible for attackers to steal sessions of users and thus admin(s). By sending users an infected URL, code will be executed.	https://www.exploit-db.com/exploits/43676
CVE-2018-5715	phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable).	https://www.exploit-db.com/exploits/43683
CVE-2018-5985	SQL Injection exists in the LiveCRM SaaS Cloud 1.0 component for Joomla! via an r=site/login&company_id= request.	https://www.exploit-db.com/exploits/43860
CVE-2018-5977	SQL Injection exists in Affiligator Affiliate Webshop Management System 2.1.0 via a search/?q=&price_type=range&price= request.	https://www.exploit-db.com/exploits/43861
CVE-2018-5986	SQL Injection exists in Easy Car Script 2014 via the s_order or s_row parameter to site_search.php.	https://www.exploit-db.com/exploits/43863
CVE-2018-5979	SQL Injection exists in Wchat Fully Responsive PHP AJAX Chat Script 1.5 via the login.php User field.	https://www.exploit-db.com/exploits/43864
CVE-2018-5978	SQL Injection exists in Facebook Style Php Ajax Chat Zechat 1.5 via the login.php User field.	https://www.exploit-db.com/exploits/43865
CVE-2018-5972	SQL Injection exists in Classified Ads CMS Quickad 4.0 via the keywords, placeid, cat, or subcat parameter to the listing URI.	https://www.exploit-db.com/exploits/43868
CVE-2018-5988	SQL Injection exists in Flexible Poll 1.2 via the id parameter to mobile_preview.php or index.php.	https://www.exploit-db.com/exploits/43869
CVE-2018-5973	SQL Injection exists in Professional Local Directory Script 1.0 via the sellers_subcategories.php IndustryID parameter, or the suppliers.php IndustryID or CategoryID parameter.	https://www.exploit-db.com/exploits/43870
CVE-2018-6363	SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.	https://www.exploit-db.com/exploits/43914
CVE-2018-6365	SQL Injection exists in TSiteBuilder 1.0 via the id parameter to /site.php, /pagelist.php, or /page_new.php.	https://www.exploit-db.com/exploits/43915
CVE-2018-6367	SQL Injection exists in Vastal I-Tech Buddy Zone Facebook Clone 2.9.9 via the /chat_im/chat_window.php request_id parameter or the /search_events.php category parameter.	https://www.exploit-db.com/exploits/43918
CVE-2018-6364	SQL Injection exists in Multilanguage Real Estate MLM Script through 3.0 via the /product-list.php srch parameter.	https://www.exploit-db.com/exploits/43917
CVE-2018-6398	SQL Injection exists in the CP Event Calendar 3.0.1 component for Joomla! via the id parameter in a task=load action.	https://www.exploit-db.com/exploits/43932
CVE-2018-6395	SQL Injection exists in the Visual Calendar 3.1.3 component for Joomla! via the id parameter in a view=load action.	https://www.exploit-db.com/exploits/43933
CVE-2018-6577	SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.	https://www.exploit-db.com/exploits/43940
CVE-2018-6578	SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.	https://www.exploit-db.com/exploits/43948
CVE-2018-6576	SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter.	https://www.exploit-db.com/exploits/43949
CVE-2018-6579	SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.	https://www.exploit-db.com/exploits/43950
CVE-2018-6575	SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.	https://www.exploit-db.com/exploits/43957
CVE-2018-6581	SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter.	https://www.exploit-db.com/exploits/43959
CVE-2018-6605	SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.	https://www.exploit-db.com/exploits/43974
CVE-2018-6604	SQL Injection exists in the Zh YandexMap 6.2.1.0 component for Joomla! via the id parameter in a task=getPlacemarkDetails request.	https://www.exploit-db.com/exploits/43975
CVE-2018-6582	SQL Injection exists in the Zh GoogleMap 8.4.0.0 component for Joomla! via the id parameter in a getPlacemarkDetails, getPlacemarkHoverText, getPathHoverText, or getPathDetails request.	https://www.exploit-db.com/exploits/43976
CVE-2018-6609	SQL Injection exists in the JSP Tickets 1.1 component for Joomla! via the ticketcode parameter in a ticketlist edit action, or the id parameter in a statuslist (or prioritylist) edit action.	https://www.exploit-db.com/exploits/43978
CVE-2018-6190	Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.	https://www.exploit-db.com/exploits/43981
CVE-2018-6845	PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.	https://www.exploit-db.com/exploits/44016
CVE-2018-6888	An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using a forged HTTP request, a malicious user can lead a user to unknowingly create / delete or modify a user account due to the lack of an anti-CSRF token.	https://www.exploit-db.com/exploits/44029
CVE-2018-6940	A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF.	https://www.exploit-db.com/exploits/44033
CVE-2018-5993	SQL Injection exists in the Aist through 2.0 component for Joomla! via the id parameter in a view=showvacancy request.	https://www.exploit-db.com/exploits/44106
CVE-2018-5990	SQL Injection exists in the AllVideos Reloaded 1.2.x component for Joomla! via the divid parameter.	https://www.exploit-db.com/exploits/44107
CVE-2018-6584	SQL Injection exists in the DT Register 3.2.7 component for Joomla! via a task=edit&id= request.	https://www.exploit-db.com/exploits/44108
CVE-2018-6373	SQL Injection exists in the Fastball 2.5 component for Joomla! via the season parameter in a view=player action.	https://www.exploit-db.com/exploits/44109
CVE-2018-6004	SQL Injection exists in the File Download Tracker 3.0 component for Joomla! via the dynfield[phone] or sess parameter.	https://www.exploit-db.com/exploits/44110
CVE-2018-5991	SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798.	https://www.exploit-db.com/exploits/44111
CVE-2018-5981	SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.	https://www.exploit-db.com/exploits/44112
CVE-2018-6396	SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! via the cid or id parameter in a layout=form_markers action, or the map parameter in a layout=default action.	https://www.exploit-db.com/exploits/44113
CVE-2018-6394	SQL Injection exists in the InviteX 3.0.5 component for Joomla! via the invite_type parameter in a view=invites action.	https://www.exploit-db.com/exploits/44114
CVE-2018-6372	SQL Injection exists in the JB Bus 2.3 component for Joomla! via the order_number parameter.	https://www.exploit-db.com/exploits/44115
CVE-2018-5970	SQL Injection exists in the JGive 2.0.9 component for Joomla! via the filter_org_ind_type or campaign_countries parameter.	https://www.exploit-db.com/exploits/44116
CVE-2018-6368	SQL Injection exists in the JomEstate PRO through 3.7 component for Joomla! via the id parameter in a task=detailed action.	https://www.exploit-db.com/exploits/44117
CVE-2018-6006	SQL Injection exists in the JS Autoz 1.0.9 component for Joomla! via the vtype, pre, or prs parameter.	https://www.exploit-db.com/exploits/44119
CVE-2018-5994	SQL Injection exists in the JS Jobs 1.1.9 component for Joomla! via the zipcode parameter in a newest-jobs request, or the ta parameter in a view_resume request.	https://www.exploit-db.com/exploits/44120
CVE-2018-5971	SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parameter.	https://www.exploit-db.com/exploits/44122
CVE-2018-6024	SQL Injection exists in the Project Log 1.5.3 component for Joomla! via the search parameter.	https://www.exploit-db.com/exploits/44124
CVE-2018-6005	SQL Injection exists in the Realpin through 1.5.04 component for Joomla! via the pinboard parameter.	https://www.exploit-db.com/exploits/44125
CVE-2018-5974	SQL Injection exists in the SimpleCalendar 3.1.9 component for Joomla! via the catid array parameter.	https://www.exploit-db.com/exploits/44126
CVE-2018-5975	SQL Injection exists in the Smart Shoutbox 3.0.0 component for Joomla! via the shoutauthor parameter to the archive URI.	https://www.exploit-db.com/exploits/44127
CVE-2018-5980	SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action.	https://www.exploit-db.com/exploits/44128
CVE-2018-5992	SQL Injection exists in the Staff Master through 1.0 RC 1 component for Joomla! via the name parameter in a view=staff request.	https://www.exploit-db.com/exploits/44129
CVE-2018-6583	SQL Injection exists in the Timetable Responsive Schedule 1.5 component for Joomla! via a view=event&alias= request.	https://www.exploit-db.com/exploits/44130
CVE-2018-5987	SQL Injection exists in the Pinterest Clone Social Pinboard 2.0 component for Joomla! via the pin_id or user_id parameter in a task=getlikeinfo action, the ends parameter in a view=gift action, the category parameter in a view=home action, the uid parameter in a view=pindisplay action, the searchVal parameter in a view=search action, or the uid parameter in a view=likes action.	https://www.exploit-db.com/exploits/44131
CVE-2018-5989	SQL Injection exists in the ccNewsletter 2.x component for Joomla! via the id parameter in a task=removeSubscriber action, a related issue to CVE-2011-5099.	https://www.exploit-db.com/exploits/44132
CVE-2018-7180	SQL Injection exists in the Saxum Astro 4.0.14 component for Joomla! via the publicid parameter.	https://www.exploit-db.com/exploits/44133
CVE-2018-7177	SQL Injection exists in the Saxum Numerology 3.0.4 component for Joomla! via the publicid parameter.	https://www.exploit-db.com/exploits/44134
CVE-2018-7179	SQL Injection exists in the SquadManagement 1.0.3 component for Joomla! via the id parameter.	https://www.exploit-db.com/exploits/44135
CVE-2018-7178	SQL Injection exists in the Saxum Picker 3.2.10 component for Joomla! via the publicid parameter.	https://www.exploit-db.com/exploits/44136
CVE-2018-7176	FrontAccounting 2.4.3 suffers from a CSRF flaw, which leads to adding a user account via admin/users.php (aka the "add user" feature of the User Permissions page).	https://www.exploit-db.com/exploits/44137
CVE- 2018-7198	October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.	https://www.exploit-db.com/exploits/44144
CVE-2018-7313	SQL Injection exists in the CW Tags 2.0.6 component for Joomla! via the searchtext array parameter.	https://www.exploit-db.com/exploits/44158
CVE-2018-7314	SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla! via the sessionid parameter, a different vulnerability than CVE-2008-6429.	https://www.exploit-db.com/exploits/44160
CVE-2018-7315	SQL Injection exists in the Ek Rishta 2.9 component for Joomla! via the gender, age1, age2, religion, mothertounge, caste, or country parameter.	https://www.exploit-db.com/exploits/44161
CVE-2018-5983	SQL Injection exists in the JquickContact 1.3.2.2.1 component for Joomla! via a task=refresh&sid= request.	https://www.exploit-db.com/exploits/44118
CVE-2018-6585	SQL Injection exists in the JTicketing 2.0.16 component for Joomla! via a view=events action with a filter_creator or filter_events_cat parameter.	https://www.exploit-db.com/exploits/44121
CVE-2018-9205	Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.	https://www.exploit-db.com/exploits/44501
CVE-2018-10109	Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in the blog catalog.	https://www.exploit-db.com/exploits/44502
CVE-2018-10310	A persistent cross-site scripting vulnerability has been identified in the web interface of the Catapult UK Cookie Consent plugin before 2.3.10 for WordPress that allows the execution of arbitrary HTML/script code in the context of a victim's browser.	https://www.exploit-db.com/exploits/44503
CVE-2018-10312	index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member.	https://www.exploit-db.com/exploits/44504
CVE-2018-9137	Open-AudIT before 2.2 has CSV Injection.	https://www.exploit-db.com/exploits/44511
CVE-2018-10258	A CSV Injection vulnerability was discovered in Shopy Point of Sale v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.	https://www.exploit-db.com/exploits/44534
CVE-2018-10255	A CSV Injection vulnerability was discovered in clustercoding Blog Master Pro v1.0 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.	https://www.exploit-db.com/exploits/44535
CVE-2018-10257	A CSV Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.	https://www.exploit-db.com/exploits/44536
CVE-2018-10256	A SQL Injection vulnerability was discovered in HRSALE The Ultimate HRM v1.0.2 that allows a user with low level privileges to directly modify the SQL query.	https://www.exploit-db.com/exploits/44537
CVE-2018-10259	An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.	https://www.exploit-db.com/exploits/44538
CVE-2018-10260	A Local File Inclusion vulnerability was found in HRSALE The Ultimate HRM v1.0.2, exploitable by a low privileged user.	https://www.exploit-db.com/exploits/44539
CVE-2018-7602	A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.	https://www.exploit-db.com/exploits/44542
CVE-2018-10366	An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.	https://www.exploit-db.com/exploits/44546
CVE-2018-10365	An XSS issue was discovered in the Threads to Link plugin 1.3 for MyBB. When editing a thread, the user is given the option to convert the thread to a link. The thread link input box is not properly sanitized.	https://www.exploit-db.com/exploits/44547
CVE-2018-10321	Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings.	https://www.exploit-db.com/exploits/44551
CVE-2018-10504	The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.	https://www.exploit-db.com/exploits/44559
CVE-2018-10309	The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields, leading to XSS.	https://www.exploit-db.com/exploits/44563
CVE-2018-10371	An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser via a page title.	https://www.exploit-db.com/exploits/44585
CVE-2018-10757	CSP MySQL User Manager 2.3.1 allows SQL injection, and resultant Authentication Bypass, via a crafted username during a login attempt.	https://www.exploit-db.com/exploits/44589
CVE-2018-10580	The "Latest Posts on Profile" plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field.	https://www.exploit-db.com/exploits/44608
CVE-2018-9155	Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the Admin->Logs section (with a logs?logs.type= URI) and the Manage->Attributes section (via the "Name (display)" field to the attributes/create URI).	https://www.exploit-db.com/exploits/44612
CVE-2018-10314	Cross-site scripting (XSS) vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover -> Audit Scripts -> List Scripts -> Download section.	https://www.exploit-db.com/exploits/44613
CVE-2018-10313	WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter to the /index.php?m=member&f=index&v=profile&set_iframe=1 URI.	https://www.exploit-db.com/exploits/44617
CVE-2018-10311	A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tag[pinyin] parameter to the /index.php?m=tags&f=index&v=add URI.	https://www.exploit-db.com/exploits/44618
CVE-2018-5430	The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which may allow any authenticated user read-only access to the contents of the web application, including key configuration files. Affected releases include TIBCO Software Inc.'s TIBCO JasperReports Server: versions up to and including 6.2.4; 6.3.0; 6.3.2; 6.3.3;6.4.0; 6.4.2, TIBCO JasperReports Server Community Edition: versions up to and including 6.4.2, TIBCO JasperReports Server for ActiveMatrix BPM: versions up to and including 6.4.2, TIBCO Jaspersoft for AWS with Multi-Tenancy: versions up to and including 6.4.2, TIBCO Jaspersoft Reporting and Analytics for AWS: versions up to and including 6.4.2.	https://www.exploit-db.com/exploits/44623
CVE-2018-7465	An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config, the editor's browser will execute everything after the </textarea>, leading to a possible XSS.	https://www.exploit-db.com/exploits/44625
CVE-2018-1247	RSA Authentication Manager Security Console, version 8.3 and earlier, contains a XML External Entity (XXE) vulnerability. This could potentially allow admin users to cause a denial of service or extract server data via injecting a maliciously crafted DTD in an XML file submitted to the application.	https://www.exploit-db.com/exploits/44634
CVE-2018-9163	A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) allows remote authenticated users (with Add New Technician permissions) to inject arbitrary web script or HTML via the loginName field to technicianAction.do.	https://www.exploit-db.com/exploits/44666
CVE-2018-11339	An XSS issue was discovered in Frappe ERPNext v11.x.x-develop b1036e5 via a comment.	https://www.exploit-db.com/exploits/44691
CVE-2018-11443	The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0.	https://www.exploit-db.com/exploits/44764
CVE-2018-11444	A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0.	https://www.exploit-db.com/exploits/44765
CVE-2018-11332	Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/save_settings.processor.php file.	https://www.exploit-db.com/exploits/44775
CVE-2018-11403	DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.	https://www.exploit-db.com/exploits/44782
CVE-2018-11404	DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.	https://www.exploit-db.com/exploits/44783
CVE-2018-11512	Stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.	https://www.exploit-db.com/exploits/44790
CVE-2018-11535	An issue was discovered in SITEMAKIN SLAC (Site Login and Access Control) v1.0. The parameter "my_item_search" in users.php is exploitable using SQL injection.	https://www.exploit-db.com/exploits/44793
CVE-2018-11523	upload.php on NUUO NVRmini 2 devices allows Arbitrary File Upload, such as upload of .php files.	https://www.exploit-db.com/exploits/44794
CVE-2018-11532	An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field.	https://www.exploit-db.com/exploits/44795
CVE-2018-11538	servlet/UserServlet in SearchBlox 8.6.6 has CSRF via the u_name, u_passwd1, u_passwd2, role, and X-XSRF-TOKEN POST parameters because of CSRF Token Bypass.	https://www.exploit-db.com/exploits/44801
CVE-2018-11522	Yosoro 1.0.4 has stored XSS.	https://www.exploit-db.com/exploits/44803
CVE-2018-10094	SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes.	https://www.exploit-db.com/exploits/44805
CVE-2018-11670	An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect.	https://www.exploit-db.com/exploits/44825
CVE-2018-11628	Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS.	https://www.exploit-db.com/exploits/44831
CVE-2018-11715	The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.	https://www.exploit-db.com/exploits/44833
CVE-2018-11581	Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html.	https://www.exploit-db.com/exploits/44839
CVE-2018-10969	SQL injection vulnerability in the Pie Register plugin before 3.0.10 for WordPress allows remote attackers to execute arbitrary SQL commands via the invitation codes grid.	https://www.exploit-db.com/exploits/44867
CVE-2018-12052	SQL Injection exists in PHP Scripts Mall Schools Alert Management Script via the q Parameter in get_sec.php.	https://www.exploit-db.com/exploits/44873
CVE-2018-12054	Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.	https://www.exploit-db.com/exploits/44874
CVE-2018-12095	A Reflected Cross-Site Scripting web vulnerability has been discovered in the OEcms v3.1 web-application. The vulnerability is located in the mod parameter of info.php.	https://www.exploit-db.com/exploits/44895
CVE-2018-12094	Cross-site scripting (XSS) vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.	https://www.exploit-db.com/exploits/44897
CVE-2018-12613	An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).	https://www.exploit-db.com/exploits/44924
CVE-2018-12613	An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication).	https://www.exploit-db.com/exploits/44928
CVE-2018-11525	The plugin "Advanced Order Export For WooCommerce" for WordPress (v1.5.4 and before) is vulnerable to CSV Injection.	https://www.exploit-db.com/exploits/44931
CVE-2018-12705	DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).	https://www.exploit-db.com/exploits/44935
CVE-2018-11526	The plugin "WordPress Comments Import & Export" for WordPress (v2.0.4 and before) is vulnerable to CSV Injection.	https://www.exploit-db.com/exploits/44940
CVE-2018-12636	The iThemes Security (better-wp-security) plugin before 7.0.3 for WordPress allows SQL Injection (by attackers with Admin privileges) via the logs page.	https://www.exploit-db.com/exploits/44943
CVE-2018-12912	An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI.	https://www.exploit-db.com/exploits/44953
CVE-2018-12519	An issue was discovered in ShopNx through 2017-11-17. The vulnerability allows a remote attacker to upload any malicious file to a Node.js application. An attacker can upload a malicious HTML file that contains a JavaScript payload to steal a user's credentials.	https://www.exploit-db.com/exploits/44978
CVE-2018-8738	Airties 5444 1.0.0.18 and 5444TT 1.0.0.18 devices allow XSS.	https://www.exploit-db.com/exploits/44986
CVE-2018-13849	edit_requests.php in yTakkar Instagram-clone through 2018-04-23 has XSS via an onmouseover payload because of an inadequate XSS protection mechanism based on preg_replace.	https://www.exploit-db.com/exploits/45003
CVE-2018-1000638	MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injection.	https://www.exploit-db.com/exploits/52175

# CVE-2017

CVE	CVE Description	Reference
CVE-2017-11471	IDERA Uptime Monitor 7.8 has SQL injection in /gadgets/definitions/uptime.CapacityWhatIfGadget/getmetrics.php via the element parameter.	https://www.exploit-db.com/exploits/44071
CVE-2017-11502	Technicolor DPC3928AD DOCSIS devices allow remote attackers to read arbitrary files via a request starting with "GET /../" on TCP port 4321.	https://www.exploit-db.com/exploits/44070
CVE-2017-11467	OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.	https://www.exploit-db.com/exploits/44068
CVE-2017-3897	A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee Security Scan Plus (MSS+) versions prior to 3.11.599.3 allows network attackers to perform a malicious file execution via a HTTP backend-response.	https://www.exploit-db.com/exploits/44067
CVE-2017-12854	No summary available for this CVE	https://www.exploit-db.com/exploits/44065
CVE-2017-7950	Nitro Pro 11.0.3 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted PCX file.	https://www.exploit-db.com/exploits/44063
CVE-2017-14335	On Beijing Hanbang Hanbanggaoke devices, because user-controlled input is not sufficiently sanitized, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.	https://www.exploit-db.com/exploits/44061
CVE-2017-13068	QNAP has already patched this vulnerability. This security concern allows a remote attacker to perform an SQL injection on the application and obtain Helpdesk application information. A remote attacker does not require any privileges to successfully execute this attack.	https://www.exploit-db.com/exploits/44060
CVE-2017-15579	In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via an aa_pages_per_page cookie in a playlist action to watch.php.	https://www.exploit-db.com/exploits/44056
CVE-2017-14960	xDashboard in OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 has SQL Injection.	https://www.exploit-db.com/exploits/43422
CVE-2017-16934	The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a change_password.csp request, which supports a "<%%25call system.exec:" string in the passwd parameter.	https://www.exploit-db.com/exploits/44051
CVE-2017-16935	Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, which allows remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml, as demonstrated by changing the admin password by obtaining account details via a users/search.json request, and then modifying the account via an editUser request.	https://www.exploit-db.com/exploits/44050
CVE-2017-16716	A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands.	https://www.exploit-db.com/exploits/43928
CVE-2017-17612	Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.	https://www.exploit-db.com/exploits/43916
CVE-2017-16921	In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user.	https://www.exploit-db.com/exploits/43853
CVE-2017-15374	Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.	https://www.exploit-db.com/exploits/43849
CVE-2017-17999	SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search parameter to index.php/knowledge_base/get_article_suggestion/.	https://www.exploit-db.com/exploits/43591
CVE-2017-17976	In Utilities.php in Perfex CRM 1.9.7, Unrestricted file upload can lead to remote code execution.	https://www.exploit-db.com/exploits/43590
CVE-2017-17970	Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to login.php; the (2) season_id parameter to themes/flixer/ajax/load_season.php; the (3) movie_id parameter to themes/flixer/ajax/get_rating.php; the (4) rating or (5) movie_id parameter to themes/flixer/ajax/update_rating.php; or the (6) id parameter to themes/flixer/ajax/set_player_source.php.	https://www.exploit-db.com/exploits/43477
CVE-2017-9554	An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors.	https://www.exploit-db.com/exploits/43455
CVE-2017-7997	Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter to (2) webapp/users/blhistory.jsp or (3) webapp/users/prhistory.jsp.	https://www.exploit-db.com/exploits/43447
CVE-2017-17098	The writeLog function in fn_common.php in gps-server.net GPS Tracking Software (self hosted) through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by <?php system($_GET[cmd]); ?> in a login request.	https://www.exploit-db.com/exploits/43431
CVE-2017-17875	The JEXTN FAQ Pro extension 4.0.0 for Joomla! has SQL Injection via the id parameter in a view=category action.	https://www.exploit-db.com/exploits/43393
CVE-2017-17721	CWEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus parameter.	https://www.exploit-db.com/exploits/43379
CVE-2017-17752	Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version 4.2.4.	https://www.exploit-db.com/exploits/43378
CVE-2017-17739	The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has directory traversal via the /storage.html rp parameter, allowing an attacker to read or write to files.	https://www.exploit-db.com/exploits/43364
CVE-2017-17672	In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.	https://www.exploit-db.com/exploits/43362
CVE-2017-10682	SQL injection vulnerability in the administrative backend in Piwigo through 2.9.1 allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.	https://www.exploit-db.com/exploits/43337
CVE-2017-17645	Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php.	https://www.exploit-db.com/exploits/43336
CVE-2017-17643	FS Lynda Clone 1.0 has SQL Injection via the keywords parameter to tutorial/.	https://www.exploit-db.com/exploits/43335
CVE-2017-17651	Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter.	https://www.exploit-db.com/exploits/43334
CVE-2017-17649	Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter.	https://www.exploit-db.com/exploits/43333
CVE-2017-16787	The Web Configuration Utility in Meinberg LANTIME devices with firmware before 6.24.004 allows remote attackers to read arbitrary files by leveraging failure to restrict URL access.	https://www.exploit-db.com/exploits/43332
CVE-2017-17872	The JEXTN Video Gallery extension 3.0.5 for Joomla! has SQL Injection via the id parameter in a view=category action.	https://www.exploit-db.com/exploits/43330
CVE-2017-17871	The "JEXTN Question And Answer" extension 3.1.0 for Joomla! has SQL Injection via the an parameter in a view=tags action, or the ques-srch parameter.	https://www.exploit-db.com/exploits/43329
CVE-2017-17870	The JBuildozer extension 1.4.1 for Joomla! has SQL Injection via the appid parameter in an entriessearch action.	https://www.exploit-db.com/exploits/43323
CVE-2017-17873	Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.	https://www.exploit-db.com/exploits/43316
CVE-2017-17642	Basic Job Site Script 2.0.5 has SQL Injection via the keyword parameter to /job.	https://www.exploit-db.com/exploits/43314
CVE-2017-17641	Resume Clone Script 2.0.5 has SQL Injection via the preview.php id parameter.	https://www.exploit-db.com/exploits/43312
CVE-2017-17640	Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter.	https://www.exploit-db.com/exploits/43311
CVE-2017-17640	Advanced World Database 2.0.5 has SQL Injection via the city.php country or state parameter, or the state.php country parameter.	https://www.exploit-db.com/exploits/43311
CVE-2017-17639	Muslim Matrimonial Script 3.02 has SQL Injection via the success-story.php succid parameter.	https://www.exploit-db.com/exploits/43310
CVE-2017-17638	Groupon Clone Script 3.01 has SQL Injection via the city_ajax.php state_id parameter.	https://www.exploit-db.com/exploits/43309
CVE-2017-17637	Car Rental Script 2.0.4 has SQL Injection via the countrycode1.php val parameter.	https://www.exploit-db.com/exploits/43308
CVE-2017-17636	MLM Forced Matrix 2.0.9 has SQL Injection via the news-detail.php newid parameter.	https://www.exploit-db.com/exploits/43307
CVE-2017-17635	MLM Forex Market Plan Script 2.0.4 has SQL Injection via the news_detail.php newid parameter or the event_detail.php eventid parameter.	https://www.exploit-db.com/exploits/43306
CVE-2017-17604	Entrepreneur Bus Booking Script 3.0.4 has SQL Injection via the booker_details.php sourcebus parameter.	https://www.exploit-db.com/exploits/43305
CVE-2017-17603	Advanced Real Estate Script 4.0.7 has SQL Injection via the search-results.php Projectmain, proj_type, searchtext, sell_price, or maxprice parameter.	https://www.exploit-db.com/exploits/43304
CVE-2017-17634	Single Theater Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.	https://www.exploit-db.com/exploits/43302
CVE-2017-17633	Multiplex Movie Theater Booking Script 3.1.5 has SQL Injection via the trailer-detail.php moid parameter, show-time.php moid parameter, or event-detail.php eid parameter.	https://www.exploit-db.com/exploits/43301
CVE-2017-17632	Responsive Events And Movie Ticket Booking Script 3.2.1 has SQL Injection via the findcity.php q parameter.	https://www.exploit-db.com/exploits/43300
CVE-2017-17631	Multireligion Responsive Matrimonial 4.7.2 has SQL Injection via the success-story.php succid parameter.	https://www.exploit-db.com/exploits/43299
CVE-2017-17628	Responsive Realestate Script 3.2 has SQL Injection via the property-list tbud parameter.	https://www.exploit-db.com/exploits/43297
CVE-2017-17627	Readymade Video Sharing Script 3.2 has SQL Injection via the single-video-detail.php report_videos array parameter.	https://www.exploit-db.com/exploits/43296
CVE-2017-17626	Readymade PHP Classified Script 3.3 has SQL Injection via the /categories subctid or mctid parameter.	https://www.exploit-db.com/exploits/43295
CVE-2017-17625	Professional Service Script 1.0 has SQL Injection via the service-list city parameter.	https://www.exploit-db.com/exploits/43294
CVE-2017-17624	PHP Multivendor Ecommerce 1.0 has SQL Injection via the single_detail.php sid parameter, or the category.php searchcat or chid1 parameter.	https://www.exploit-db.com/exploits/43293
CVE-2017-17623	Opensource Classified Ads Script 3.2 has SQL Injection via the advance_result.php keyword parameter.	https://www.exploit-db.com/exploits/43292
CVE-2017-17622	Online Exam Test Application Script 1.6 has SQL Injection via the exams.php sort parameter.	https://www.exploit-db.com/exploits/43291
CVE-2017-17621	Multivendor Penny Auction Clone Script 1.0 has SQL Injection via the PATH_INFO to the /detail URI.	https://www.exploit-db.com/exploits/43290
CVE-2017-17620	Lawyer Search Script 1.1 has SQL Injection via the /lawyer-list city parameter.	https://www.exploit-db.com/exploits/43289
CVE-2017-17619	Laundry Booking Script 1.0 has SQL Injection via the /list city parameter.	https://www.exploit-db.com/exploits/43288
CVE-2017-17629	Secure E-commerce Script 2.0.1 has SQL Injection via the category.php searchmain or searchcat parameter, or the single_detail.php sid parameter.	https://www.exploit-db.com/exploits/43287
CVE-2017-17618	Kickstarter Clone Script 2.0 has SQL Injection via the investcalc.php projid parameter.	https://www.exploit-db.com/exploits/43286
CVE-2017-17617	Foodspotting Clone Script 1.0 has SQL Injection via the quicksearch.php q parameter.	https://www.exploit-db.com/exploits/43285
CVE-2017-17612	Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.	https://www.exploit-db.com/exploits/43284
CVE-2017-17613	Freelance Website Script 2.0.6 has SQL Injection via the jobdetails.php pr_id parameter or the searchbycat_list.php catid parameter.	https://www.exploit-db.com/exploits/43283
CVE-2017-17630	Yoga Class Script 1.0 has SQL Injection via the /list city parameter.	https://www.exploit-db.com/exploits/43282
CVE-2017-17614	Food Order Script 1.0 has SQL Injection via the /list city parameter.	https://www.exploit-db.com/exploits/43281
CVE-2017-17615	Facebook Clone Script 1.0 has SQL Injection via the friend-profile.php id parameter.	https://www.exploit-db.com/exploits/43280
CVE-2017-17616	Event Search Script 1.0 has SQL Injection via the /event-list city parameter.	https://www.exploit-db.com/exploits/43279
CVE-2017-17648	Entrepreneur Dating Script 2.0.1 has SQL Injection via the search_result.php marital, gender, country, or profileid parameter.	https://www.exploit-db.com/exploits/43278
CVE-2017-17610	E-commerce MLM Software 1.0 has SQL Injection via the service_detail.php pid parameter, event_detail.php eventid parameter, or news_detail.php newid parameter.	https://www.exploit-db.com/exploits/43277
CVE-2017-17611	Doctor Search Script 1.0 has SQL Injection via the /list city parameter.	https://www.exploit-db.com/exploits/43276
CVE-2017-17596	Entrepreneur Job Portal Script 2.0.6 has SQL Injection via the jobsearch_all.php rid1 parameter.	https://www.exploit-db.com/exploits/43275
CVE-2017-17605	Consumer Complaints Clone Script 1.0 has SQL Injection via the other-user-profile.php id parameter.	https://www.exploit-db.com/exploits/43274
CVE-2017-17606	Co-work Space Search Script 1.0 has SQL Injection via the /list city parameter.	https://www.exploit-db.com/exploits/43273
CVE-2017-17607	CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail.	https://www.exploit-db.com/exploits/43272
CVE-2017-17608	Child Care Script 1.0 has SQL Injection via the /list city parameter.	https://www.exploit-db.com/exploits/43271
CVE-2017-17609	Chartered Accountant Booking Script 1.0 has SQL Injection via the /service-list city parameter.	https://www.exploit-db.com/exploits/43270
CVE-2017-17601	Cab Booking Script 1.0 has SQL Injection via the /service-list city parameter.	https://www.exploit-db.com/exploits/43269
CVE-2017-17597	Nearbuy Clone Script 3.2 has SQL Injection via the category_list.php search parameter.	https://www.exploit-db.com/exploits/43268
CVE-2017-17595	Beauty Parlour Booking Script 1.0 has SQL Injection via the /list gender or city parameter.	https://www.exploit-db.com/exploits/43267
CVE-2017-17600	Basic B2B Script 2.0.8 has SQL Injection via the product_details.php id parameter.	https://www.exploit-db.com/exploits/43266
CVE-2017-17598	Affiliate MLM Script 1.0 has SQL Injection via the product-category.php key parameter.	https://www.exploit-db.com/exploits/43265
CVE-2017-17599	Advance Online Learning Management Script 3.1 has SQL Injection via the courselist.php subcatid or popcourseid parameter.	https://www.exploit-db.com/exploits/43264
CVE-2017-17602	Advance B2B Script 2.1.3 has SQL Injection via the tradeshow-list-detail.php show_id or view-product.php pid parameter.	https://www.exploit-db.com/exploits/43263
CVE-2017-17571	FS Foodpanda Clone 1.0 has SQL Injection via the /food keywords parameter.	https://www.exploit-db.com/exploits/43262
CVE-2017-17570	FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php fl_orig or fl_dest parameter.	https://www.exploit-db.com/exploits/43261
CVE-2017-8841	Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.	https://www.exploit-db.com/exploits/42130
CVE-2017-8840	Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.	https://www.exploit-db.com/exploits/42130
CVE-2017-8839	Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.	https://www.exploit-db.com/exploits/42130
CVE-2017-8838	Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.	https://www.exploit-db.com/exploits/42130
CVE-2017-8837	Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.	https://www.exploit-db.com/exploits/42130
CVE-2017-8836	Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.	https://www.exploit-db.com/exploits/42130
CVE-2017-8835	Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.	https://www.exploit-db.com/exploits/42130
CVE-2017-9414	Cross-site request forgery (CSRF) vulnerability in the Subscribe to Podcast feature in Subsonic 6.1.1 allows remote attackers to hijack the authentication of unspecified victims for requests that conduct cross-site scripting (XSS) attacks or possibly have unspecified other impact via the name parameter to playerSettings.view.	https://www.exploit-db.com/exploits/42120
CVE-2017-6529	An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.	https://www.exploit-db.com/exploits/41578
CVE-2017-17577	FS Trademe Clone 1.0 has SQL Injection via the search_item.php search parameter or the general_item_details.php id parameter.	https://www.exploit-db.com/exploits/43260
CVE-2017-17572	FS Amazon Clone 1.0 has SQL Injection via the PATH_INFO to /VerAyari.	https://www.exploit-db.com/exploits/43259
CVE-2017-17574	FS Care Clone 1.0 has SQL Injection via the searchJob.php jobType or jobFrequency parameter.	https://www.exploit-db.com/exploits/43258
CVE-2017-17578	FS Crowdfunding Script 1.0 has SQL Injection via the latest_news_details.php id parameter.	https://www.exploit-db.com/exploits/43257
CVE-2017-17573	FS Ebay Clone 1.0 has SQL Injection via the product.php id parameter, or the search.php category_id or sub_category_id parameter.	https://www.exploit-db.com/exploits/43256
CVE-2017-17579	FS Freelancer Clone 1.0 has SQL Injection via the profile.php u parameter.	https://www.exploit-db.com/exploits/43255
CVE-2017-17576	FS Gigs Script 1.0 has SQL Injection via the browse-category.php cat parameter, browse-scategory.php sc parameter, or service-provider.php ser parameter.	https://www.exploit-db.com/exploits/43254
CVE-2017-17575	FS Groupon Clone 1.0 has SQL Injection via the item_details.php id parameter or the vendor_details.php id parameter.	https://www.exploit-db.com/exploits/43253
CVE-2017-17582	FS Grubhub Clone 1.0 has SQL Injection via the /food keywords parameter.	https://www.exploit-db.com/exploits/43252
CVE-2017-17588	FS IMDB Clone 1.0 has SQL Injection via the movie.php f parameter, tvshow.php s parameter, or show_misc_video.php id parameter.	https://www.exploit-db.com/exploits/43251
CVE-2017-17587	FS Indiamart Clone 1.0 has SQL Injection via the catcompany.php token parameter, buyleads-details.php id parameter, or company/index.php c parameter.	https://www.exploit-db.com/exploits/43250
CVE-2017-17580	FS Linkedin Clone 1.0 has SQL Injection via the group.php grid parameter, profile.php fid parameter, or company_details.php id parameter.	https://www.exploit-db.com/exploits/43249
CVE-2017-17584	FS Makemytrip Clone 1.0 has SQL Injection via the show-flight-result.php fl_orig or fl_dest parameter.	https://www.exploit-db.com/exploits/43246
CVE-2017-17585	FS Monster Clone 1.0 has SQL Injection via the Employer_Details.php id parameter.	https://www.exploit-db.com/exploits/43245
CVE-2017-17586	FS Olx Clone 1.0 has SQL Injection via the subpage.php scat parameter or the message.php pid parameter.	https://www.exploit-db.com/exploits/43244
CVE-2017-17581	FS Quibids Clone 1.0 has SQL Injection via the itechd.php productid parameter.	https://www.exploit-db.com/exploits/43243
CVE-2017-17583	FS Shutterstock Clone 1.0 has SQL Injection via the /Category keywords parameter.	https://www.exploit-db.com/exploits/43242
CVE-2017-17590	FS Stackoverflow Clone 1.0 has SQL Injection via the /question keywords parameter.	https://www.exploit-db.com/exploits/43241
CVE-2017-17589	FS Thumbtack Clone 1.0 has SQL Injection via the browse-category.php cat parameter or the browse-scategory.php sc parameter.	https://www.exploit-db.com/exploits/43240
CVE-2017-17591	Realestate Crowdfunding Script 2.7.2 has SQL Injection via the single-cause.php pid parameter.	https://www.exploit-db.com/exploits/43239
CVE-2017-17592	Website Auction Marketplace 2.0.5 has SQL Injection via the search.php cat_id parameter.	https://www.exploit-db.com/exploits/43238
CVE-2017-17594	DomainSale PHP Script 1.0 has SQL Injection via the domain.php id parameter.	https://www.exploit-db.com/exploits/43235
CVE-2017-17111	Posty Readymade Classifieds Script 1.0 allows an attacker to inject SQL commands via a listings.php?catid= or ads-details.php?ID= request.	https://www.exploit-db.com/exploits/43212
CVE-2017-17110	Techno Portfolio Management Panel 1.0 allows an attacker to inject SQL commands via a single.php?id= request.	https://www.exploit-db.com/exploits/43211
CVE-2017-17055	Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the username-form-id parameter to freeradius.users.php.	https://www.exploit-db.com/exploits/43206
CVE-2017-16884	Cross-site scripting (XSS) vulnerability in MistServer before 2.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to failed authentication requests alerts.	https://www.exploit-db.com/exploits/43205
CVE-2017-16962	The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component.	https://www.exploit-db.com/exploits/43177
CVE-2017-16819	A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows remote attackers to inject arbitrary JavaScript in the nameFirst (aka First Name) field for the employee details page (/employee.html) that is then reflected in multiple pages where that field data is utilized, resulting in session hijacking and possible elevation of privileges.	https://www.exploit-db.com/exploits/43158
CVE-2017-16843	Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic.	https://www.exploit-db.com/exploits/43150
CVE-2017-16841	LanSweeper 6.0.100.75 has XSS via the description parameter to /Calendar/CalendarActions.aspx.	https://www.exploit-db.com/exploits/43149
CVE-2017-16781	The installer in MyBB before 1.8.13 has XSS.	https://www.exploit-db.com/exploits/43137
CVE-2017-16780	The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file.	https://www.exploit-db.com/exploits/43136
CVE-2017-16543	Zoho ManageEngine Applications Manager 13 before build 13500 allows SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.	https://www.exploit-db.com/exploits/43129
CVE-2017-16568	Cross-site scripting (XSS) vulnerability in Logitech Media Server 7.9.0 allows remote attackers to inject arbitrary web script or HTML via a radio URL.	https://www.exploit-db.com/exploits/43123
CVE-2017-16567	Cross-site scripting (XSS) vulnerability in Logitech Media Server 7.9.0 allows remote attackers to inject arbitrary web script or HTML via a "favorite."	https://www.exploit-db.com/exploits/43122
CVE-2017-3548	Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).	https://www.exploit-db.com/exploits/43114
CVE-2017-15958	D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php.	https://www.exploit-db.com/exploits/43101
CVE-2017-15959	Adult Script Pro 2.2.4 allows SQL Injection via the PATH_INFO to a /download URI, a different vulnerability than CVE-2007-6576.	https://www.exploit-db.com/exploits/43100
CVE-2017-15960	Article Directory Script 3.0 allows SQL Injection via the id parameter to author.php or category.php.	https://www.exploit-db.com/exploits/43099
CVE-2017-15961	iProject Management System 1.0 allows SQL Injection via the ID parameter to index.php.	https://www.exploit-db.com/exploits/43098
CVE-2017-15963	iTech Gigs Script 1.21 allows SQL Injection via the browse-scategory.php sc parameter or the service-provider.php ser parameter.	https://www.exploit-db.com/exploits/43096
CVE-2017-15964	Job Board Script Software allows SQL Injection via the PATH_INFO to a /job-details URI.	https://www.exploit-db.com/exploits/43095
CVE-2017-15965	The NS Download Shop (aka com_ns_downloadshop) component 2.2.6 for Joomla! allows SQL Injection via the id parameter in an invoice.create action.	https://www.exploit-db.com/exploits/43094
CVE-2017-15968	MyBuilder Clone 1.0 allows SQL Injection via the phpsqlsearch_genxml.php subcategory parameter.	https://www.exploit-db.com/exploits/43091
CVE-2017-15969	PG All Share Video 1.0 allows SQL Injection via the PATH_INFO to search/tag, friends/index, users/profile, or video_catalog/category.	https://www.exploit-db.com/exploits/43090
CVE-2017-15970	PHP CityPortal 2.0 allows SQL Injection via the nid parameter to index.php in a page=news action, or the cat parameter.	https://www.exploit-db.com/exploits/43089
CVE-2017-15971	Same Sex Dating Software Pro 1.0 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Email field, a related issue to CVE-2017-15972.	https://www.exploit-db.com/exploits/43088
CVE-2017-15972	SoftDatepro Dating Social Network 1.3 allows SQL Injection via the viewprofile.php profid parameter, the viewmessage.php sender_id parameter, or the /admin Email field, a related issue to CVE-2017-15971.	https://www.exploit-db.com/exploits/43087
CVE-2017-15973	Sokial Social Network Script 1.0 allows SQL Injection via the id parameter to admin/members_view.php.	https://www.exploit-db.com/exploits/43086
CVE-2017-15974	tPanel 2009 allows SQL injection for Authentication Bypass via 'or 1=1 or ''=' to login.php.	https://www.exploit-db.com/exploits/43085
CVE-2017-15975	Vastal I-Tech Dating Zone 0.9.9 allows SQL Injection via the 'product_id' to add_to_cart.php, a different vulnerability than CVE-2008-4461.	https://www.exploit-db.com/exploits/43084
CVE-2017-15976	ZeeBuddy 2x allows SQL Injection via the admin/editadgroup.php groupid parameter, a different vulnerability than CVE-2008-3604.	https://www.exploit-db.com/exploits/43083
CVE-2017-15977	Protected Links - Expiring Download Links 1.0 allows SQL Injection via the username parameter.	https://www.exploit-db.com/exploits/43082
CVE-2017-15978	AROX School ERP PHP Script 1.0 allows SQL Injection via the office_admin/ id parameter.	https://www.exploit-db.com/exploits/43081
CVE-2017-15979	Shareet - Photo Sharing Social Network 1.0 allows SQL Injection via the photo parameter.	https://www.exploit-db.com/exploits/43080
CVE-2017-15980	US Zip Codes Database Script 1.0 allows SQL Injection via the state parameter.	https://www.exploit-db.com/exploits/43079
CVE-2017-15981	Responsive Newspaper Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.	https://www.exploit-db.com/exploits/43078
CVE-2017-15982	Dynamic News Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.	https://www.exploit-db.com/exploits/43077
CVE-2017-15983	MyMagazine Magazine & Blog CMS 1.0 allows SQL Injection via the id parameter to admin/admin_process.php for form editing.	https://www.exploit-db.com/exploits/43076
CVE-2017-15984	Creative Management System (CMS) Lite 1.4 allows SQL Injection via the S parameter to index.php.	https://www.exploit-db.com/exploits/43075
CVE-2017-15985	Basic B2B Script allows SQL Injection via the product_view1.php pid or id parameter.	https://www.exploit-db.com/exploits/43074
CVE-2017-15986	CPA Lead Reward Script allows SQL Injection via the username parameter.	https://www.exploit-db.com/exploits/43073
CVE-2017-15987	Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter.	https://www.exploit-db.com/exploits/43072
CVE-2017-15988	Nice PHP FAQ Script allows SQL Injection via the index.php nice_theme parameter, a different vulnerability than CVE-2008-6525.	https://www.exploit-db.com/exploits/43071
CVE-2017-15989	Online Exam Test Application allows SQL Injection via the resources.php sort parameter in a category action.	https://www.exploit-db.com/exploits/43070
CVE-2017-15991	Vastal I-Tech Agent Zone (aka The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, or searchResidential.php via the property_type, city, or bedroom parameter, a different vulnerability than CVE-2008-3951, CVE-2009-3497, and CVE-2012-0982.	https://www.exploit-db.com/exploits/43068
CVE-2017-15992	Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.	https://www.exploit-db.com/exploits/43067
CVE-2017-15993	Zomato Clone Script allows SQL Injection via the restaurant-menu.php resid parameter.	https://www.exploit-db.com/exploits/43066
CVE-2017-15727	In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.	https://www.exploit-db.com/exploits/43063
CVE-2017-15081	In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.	https://www.exploit-db.com/exploits/43062
CVE-2017-5223	An issue was discovered in PHPMailer before 5.2.22. PHPMailer's msgHTML method applies transformations to an HTML document to make it usable as an email message body. One of the transformations is to convert relative image URLs into attachments using a script-provided base directory. If no base directory is provided, it resolves to /, meaning that relative image URLs get treated as absolute local file paths and added as attachments. To form a remote vulnerability, the msgHTML method must be called, passed an unfiltered, user-supplied HTML document, and must not set a base directory.	https://www.exploit-db.com/exploits/43056
CVE-2017-15878	A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.	https://www.exploit-db.com/exploits/43054
CVE-2017-15879	CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.	https://www.exploit-db.com/exploits/43053
CVE-2017-14143	The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.	https://www.exploit-db.com/exploits/43028
CVE-2017-15687	DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI.	https://www.exploit-db.com/exploits/43024
CVE-2017-15291	Cross-site scripting (XSS) vulnerability in the Wireless MAC Filtering page in TP-LINK TL-MR3220 wireless routers allows remote attackers to inject arbitrary web script or HTML via the Description field.	https://www.exploit-db.com/exploits/43023
CVE-2017-15359	In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file=" and "/api/SupportInfo?file=" are the vulnerable parameters. An attacker must be authenticated to exploit this issue to access sensitive information to aid in subsequent attacks.	https://www.exploit-db.com/exploits/42991
CVE-2017-14619	Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the "Title of your FAQ" field in the Configuration Module.	https://www.exploit-db.com/exploits/42987
CVE-2017-15287	There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI.	https://www.exploit-db.com/exploits/42986
CVE-2017-12479	It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute arbitrary commands with root privileges.	https://www.exploit-db.com/exploits/42959
CVE-2017-12615	When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.	https://www.exploit-db.com/exploits/42953
CVE-2017-14717	In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Description parameter.	https://www.exploit-db.com/exploits/42950
CVE-2017-14758	OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection: /xAdmin/html/cm_doclist_view_uc.jsp, parameter: documentId. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.	https://www.exploit-db.com/exploits/42940
CVE-2017-14757	OpenText Document Sciences xPression (formerly EMC Document Sciences xPression) v4.5SP1 Patch 13 (older versions might be affected as well) is prone to SQL Injection: /xDashboard/html/jobhistory/downloadSupportFile.action, parameter: jobRunId. In order for this vulnerability to be exploited, an attacker must authenticate to the application first.	https://www.exploit-db.com/exploits/42939
CVE-2017-6089	SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or id parameters to topics/deletetopics.php; the (2) id parameter to bookmarks/deletebookmarks.php; or the (3) id parameter to calendar/deletecalendar.php.	https://www.exploit-db.com/exploits/42935
CVE-2017-14848	WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.	https://www.exploit-db.com/exploits/42924
CVE-2017-14620	SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Scripting.	https://www.exploit-db.com/exploits/42923
CVE-2017-14738	FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module (under the search function).	https://www.exploit-db.com/exploits/42922
CVE-2017-14848	WPHRM Human Resource Management System for WordPress 1.0 allows SQL Injection via the employee_id parameter.	https://www.exploit-db.com/exploits/42924
CVE-2017-14620	SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in Stored Cross Site Scripting.	https://www.exploit-db.com/exploits/42923
CVE-2017-14738	FileRun (version 2017.09.18 and below) suffers from a remote SQL injection vulnerability due to a failure to sanitize input in the metafield parameter inside the metasearch module (under the search function).	https://www.exploit-db.com/exploits/42922
CVE-2017-14847	Mojoomla WPAMS Apartment Management System for WordPress allows SQL Injection via the id parameter.	https://www.exploit-db.com/exploits/42805
CVE-2017-14843	Mojoomla School Management System for WordPress allows SQL Injection via the id parameter.	https://www.exploit-db.com/exploits/42804
CVE-2017-14846	Mojoomla Hospital Management System for WordPress allows SQL Injection via the id parameter.	https://www.exploit-db.com/exploits/42802
CVE-2017-14844	Mojoomla WPGYM WordPress Gym Management System allows SQL Injection via the id parameter.	https://www.exploit-db.com/exploits/42801
CVE-2017-14845	Mojoomla WPCHURCH Church Management System for WordPress allows SQL Injection via the id parameter.	https://www.exploit-db.com/exploits/42800
CVE-2017-14842	Mojoomla SMSmaster Multipurpose SMS Gateway for WordPress allows SQL Injection via the id parameter.	https://www.exploit-db.com/exploits/42798
CVE-2017-14507	Multiple SQL injection vulnerabilities in the Content Timeline plugin 4.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) timeline parameter in content_timeline_class.php; or the id parameter to (2) pages/content_timeline_edit.php or (3) pages/content_timeline_index.php.	https://www.exploit-db.com/exploits/42794
CVE-2017-14703	SQL injection vulnerability in Cash Back Comparison Script 1.0 allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to search/.	https://www.exploit-db.com/exploits/42772
CVE-2017-14618	Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php in phpMyFAQ through 2.9.8 allows remote attackers to inject arbitrary web script or HTML via the Questions field in an "Add New FAQ" action.	https://www.exploit-db.com/exploits/42761
CVE-2017-12930	SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version >1.5.10 allows remote unauthenticated users to access the web interface as administrator via a crafted password.	https://www.exploit-db.com/exploits/42754
CVE-2017-9798	Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.	https://www.exploit-db.com/exploits/42745
CVE-2017-11435	The Humax Wi-Fi Router model HG100R-* 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. The bug is exploitable remotely when the router is configured to expose the management console. The router is not validating the session token while returning answers for some methods in url '/api'. An attacker can use this vulnerability to retrieve sensitive information such as private/public IP addresses, SSID names, and passwords.	https://www.exploit-db.com/exploits/42732
CVE-2017-14396	In osTicket before 1.10.1, SQL injection is possible by constructing an array via use of square brackets at the end of a parameter name, as demonstrated by the key parameter to file.php.	https://www.exploit-db.com/exploits/42660
CVE-2017-14219	XSS (persistent) on the Intelbras Wireless N 150Mbps router with firmware WRN 240 allows attackers to steal wireless credentials without being connected to the network, related to userRpm/popupSiteSurveyRpm.htm and userRpm/WlanSecurityRpm.htm. The attack vector is a crafted ESSID, as demonstrated by an "airbase-ng -e" command.	https://www.exploit-db.com/exploits/42633
CVE-2017-14126	The Participants Database plugin before 1.7.5.10 for WordPress has XSS.	https://www.exploit-db.com/exploits/42618
CVE-2017-13754	Cross-site scripting (XSS) vulnerability in the "advanced settings - time server" module in Wibu-Systems CodeMeter before 6.50b allows remote attackers to inject arbitrary web script or HTML via the "server name" field in actions/ChangeConfiguration.html.	https://www.exploit-db.com/exploits/42610
CVE-2017-13713	T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters in the user parameter to cgi-bin/webupg.	https://www.exploit-db.com/exploits/42608
CVE-2017-12943	D-Link DIR-600 Rev Bx devices with v2.x firmware allow remote attackers to read passwords via a model/__show_info.php?REQUIRE_FILE= absolute path traversal attack, as demonstrated by discovering the admin password.	https://www.exploit-db.com/exploits/42581
CVE-2017-8770	There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the entire filesystem on the device via a crafted getpage parameter.	https://www.exploit-db.com/exploits/42547
CVE-2017-12984	PHPMyWind 5.3 has XSS in shoppingcart.php, related to message.php, admin/message.php, and admin/message_update.php.	https://www.exploit-db.com/exploits/42535
CVE-2017-12971	Cross-site scripting (XSS) vulnerability in Apache2Triad 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the account parameter to phpsftpd/users.php.	https://www.exploit-db.com/exploits/42520
CVE-2017-6327	The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges.	https://www.exploit-db.com/exploits/42519
CVE-2017-9979	On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1, if the REST call invoked does not exist, an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter, aka XSS.	https://www.exploit-db.com/exploits/42517
CVE-2017-9767	Multiple cross-site scripting (XSS) vulnerabilities in Quali CloudShell before 8 allow remote authenticated users to inject arbitrary web script or HTML via the (1) Name or (2) Description parameter to RM/Reservation/ReserveNew; the (3) Description parameter to RM/Topology/Update; the (4) Name, (5) Description, (6) ExecutionBatches[0].Name, (7) ExecutionBatches[0].Description, or (8) Labels parameter to SnQ/JobTemplate/Edit; or (9) Alias or (10) Description parameter to RM/AbstractTemplate/AddOrUpdateAbstractTemplate.	https://www.exploit-db.com/exploits/42453
CVE-2017-11155	An information exposure vulnerability in index.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to obtain sensitive system information via unspecified vectors.	https://www.exploit-db.com/exploits/42434
CVE-2017-11320	Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker to cause DNS Poisoning and steal credentials from the router.	https://www.exploit-db.com/exploits/42427
CVE-2017-11494	SQL injection vulnerability in SOL.Connect ISET-mpp meter 1.2.4.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a login action.	https://www.exploit-db.com/exploits/42408
CVE-2017-3133	A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to execute unauthorized code or commands via the Replacement Message HTML for SSL-VPN.	https://www.exploit-db.com/exploits/42388
CVE-2017-11346	Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.	https://www.exploit-db.com/exploits/42358
CVE-2017-11356	The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration information by leveraging a missing access control.	https://www.exploit-db.com/exploits/42335
CVE-2017-7175	NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter (aka the "Custom output format" field).	https://www.exploit-db.com/exploits/42314
CVE-2017-6971	AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862.	https://www.exploit-db.com/exploits/42306
CVE-2017-9834	SQL injection vulnerability in the WatuPRO plugin before 5.5.3.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.	https://www.exploit-db.com/exploits/42291
CVE-2017-9833	/cgi-bin/wapopen in Boa 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges. NOTE: multiple third parties report that this is a system-integrator issue (e.g., a vulnerability on one type of camera) because Boa does not include any wapopen program or any code to read a FILECAMERA variable.	https://www.exploit-db.com/exploits/42290
CVE-2017-9813	In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting (XSS).	https://www.exploit-db.com/exploits/42269
CVE-2017-9812	In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting (XSS).	https://www.exploit-db.com/exploits/42269
CVE-2017-9811	In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting (XSS).	https://www.exploit-db.com/exploits/42269
CVE-2017-9810	In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312), the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting (XSS).	https://www.exploit-db.com/exploits/42269
CVE-2017-9730	SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the "r" parameter.	https://www.exploit-db.com/exploits/42193
CVE-2017-9429	SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php.	https://www.exploit-db.com/exploits/42173
CVE-2017-9603	SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php.	https://www.exploit-db.com/exploits/42172
CVE-2017-9418	SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php.	https://www.exploit-db.com/exploits/42166
CVE-2017-9516	Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.	https://www.exploit-db.com/exploits/42143
CVE-2017-2528	An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with cached frames.	https://www.exploit-db.com/exploits/42105
CVE-2017-2510	An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with pageshow events.	https://www.exploit-db.com/exploits/42067
CVE-2017-2508	An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with container nodes.	https://www.exploit-db.com/exploits/42066
CVE-2017-2504	An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with WebKit Editor commands.	https://www.exploit-db.com/exploits/42064
CVE-2017-5631	An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string.	https://www.exploit-db.com/exploits/42042
CVE-2017-8917	SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.	https://www.exploit-db.com/exploits/42033
CVE-2017-7953	INFOR EAM V11.0 Build 201410 has XSS via comment fields.	https://www.exploit-db.com/exploits/42029
CVE-2017-7952	INFOR EAM V11.0 Build 201410 has SQL injection via search fields, related to the filtervalue parameter.	https://www.exploit-db.com/exploits/42028
CVE-2017-8912	CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions. NOTE: the vendor reportedly has stated this is "a feature, not a bug.	https://www.exploit-db.com/exploits/41997
CVE-2017-7981	Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used within PhpWiki before 1.5.5 with a syntax value in its first argument, and an authenticated Tuleap user can control this value, even with shell metacharacters, as demonstrated by a '<?plugin SyntaxHighlighter syntax="c;id"' line to execute the id command.	https://www.exploit-db.com/exploits/41953
CVE-2017-5799	A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3.x), all versions prior to 4.4.7 RP702 (for OCMP 4.x).	https://www.exploit-db.com/exploits/41927
CVE-2017-3549	Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).	https://www.exploit-db.com/exploits/41926
CVE-2017-2479	An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.	https://www.exploit-db.com/exploits/41866
CVE-2017-2480	An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.	https://www.exploit-db.com/exploits/41865
CVE-2017-6361	QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.	https://www.exploit-db.com/exploits/41842
CVE-2017-6190	Directory traversal vulnerability in the web interface on the D-Link DWR-116 device with firmware before V1.05b09 allows remote attackers to read arbitrary files via a .. (dot dot) in a "GET /uir/" request.	https://www.exploit-db.com/exploits/41840
CVE-2017-2641	In Moodle 2.x and 3.x, SQL injection can occur via user preferences.	https://www.exploit-db.com/exploits/41828
CVE-2017-2445	An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.	https://www.exploit-db.com/exploits/41802
CVE-2017-6884	A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.	https://www.exploit-db.com/exploits/41782
CVE-2017-6088	Multiple SQL injection vulnerabilities in EyesOfNetwork (aka EON) 5.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) bp_name, (2) display, (3) search, or (4) equipment parameter to module/monitoring_ged/ged_functions.php or the (5) type parameter to monitoring_ged/ajax.php.	https://www.exploit-db.com/exploits/41747
CVE-2017-6087	EyesOfNetwork ("EON") 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected_events[] parameter in the (1) acknowledge, (2) delete, or (3) ownDisown function in module/monitoring_ged/ged_functions.php or the (4) module parameter to module/index.php.	https://www.exploit-db.com/exploits/41746
CVE-2017-6550	Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands via the (1) TABLE parameter to esbus/servlet/GetSQLData or (2) QUERY parameter to KK_LS9ReportingPortal/GetData.	https://www.exploit-db.com/exploits/41577
CVE-2017-6547	Cross-site scripting (XSS) vulnerability in httpd on ASUS RT-N56U, RT-N66U, RT-AC66U, RT-N66R, RT-AC66R, RT-AC68U, RT-AC68R, RT-N66W, RT-AC66W, RT-AC87R, RT-AC87U, RT-AC51U, RT-AC68P, RT-N11P, RT-N12+, RT-N12E B1, RT-AC3200, RT-AC53U, RT-AC1750, RT-AC1900P, RT-N300, and RT-AC750 routers with firmware before 3.0.0.4.380.7378; RT-AC68W routers with firmware before 3.0.0.4.380.7266; and RT-N600, RT-N12+ B1, RT-N11P B1, RT-N12VP B1, RT-N12E C1, RT-N300 B1, and RT-N12+ Pro routers with firmware before 3.0.0.4.380.9488 allows remote attackers to inject arbitrary JavaScript by requesting filenames longer than 50 characters.	https://www.exploit-db.com/exploits/41571
CVE-2017-6443	Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web script or HTML via the W_AD1 parameter to Forms/oadmin_1.	https://www.exploit-db.com/exploits/41502
CVE-2017-2371	An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. The issue involves the "WebKit" component, which allows remote attackers to launch popups via a crafted web site.	https://www.exploit-db.com/exploits/41451
CVE-2017-6098	A SQL injection issue was discovered in the Mail Masta (aka mail-masta) plugin 1.0 for WordPress. This affects /inc/campaign_save.php (Requires authentication to Wordpress admin) with the POST Parameter: list_id.	https://www.exploit-db.com/exploits/41438
CVE-2017-5344	An issue was discovered in dotCMS through 3.6.1. The findChildrenByFilter() function which is called by the web accessible path /categoriesServlet performs string interpolation and direct SQL query execution. SQL quote escaping and a keyword blacklist were implemented in a new class, SQLUtil (main/java/com/dotmarketing/common/util/SQLUtil.java), as part of the remediation of CVE-2016-8902; however, these can be overcome in the case of the q and inode parameters to the /categoriesServlet path. Overcoming these controls permits a number of blind boolean SQL injection vectors in either parameter. The /categoriesServlet web path can be accessed remotely and without authentication in a default dotCMS deployment.	https://www.exploit-db.com/exploits/41377
CVE-2017-5174	An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution.	https://www.exploit-db.com/exploits/41360
CVE-2017-16836	Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajax_managed_services.php service parameter.	https://www.exploit-db.com/exploits/38657
CVE-2017-15367	Bacula-web before 8.0.0-rc2 is affected by multiple SQL Injection vulnerabilities that could allow an attacker to access the Bacula database and, depending on configuration, escalate privileges on the server.	https://www.exploit-db.com/exploits/44272
CVE-2017-16716	A SQL Injection issue was discovered in WebAccess versions prior to 8.3. WebAccess does not properly sanitize its inputs for SQL commands.	https://www.exploit-db.com/exploits/43928
CVE-2017-17612	Hot Scripts Clone 3.1 has SQL Injection via the /categories subctid or mctid parameter.	https://www.exploit-db.com/exploits/43916
CVE-2017-15374	Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.	https://www.exploit-db.com/exploits/43849
CVE-2017-17999	SQL injection vulnerability in RISE Ultimate Project Manager 1.9 allows remote attackers to execute arbitrary SQL commands via the search parameter to index.php/knowledge_base/get_article_suggestion/.	https://www.exploit-db.com/exploits/43591
CVE-2017-17970	Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) email parameter to login.php; the (2) season_id parameter to themes/flixer/ajax/load_season.php; the (3) movie_id parameter to themes/flixer/ajax/get_rating.php; the (4) rating or (5) movie_id parameter to themes/flixer/ajax/update_rating.php; or the (6) id parameter to themes/flixer/ajax/set_player_source.php.	https://www.exploit-db.com/exploits/43477
CVE-2017-7997	Multiple SQL injection vulnerabilities in Gespage before 7.4.9 allow remote attackers to execute arbitrary SQL commands via the (1) show_prn parameter to webapp/users/prnow.jsp or show_month parameter to (2) webapp/users/blhistory.jsp or (3) webapp/users/prhistory.jsp.	https://www.exploit-db.com/exploits/43447

# CVE-2012

CVE	CVE Description	Reference
CVE-2012-0297	The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.	https://www.exploit-db.com/exploits/18932
CVE-2012-6708	jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.	https://www.exploit-db.com/exploits/49708

# CVE-2011

CVE	CVE Description	Reference
CVE-2011-4969	Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.	https://nvd.nist.gov/vuln/detail/cve-2011-4969

# CVE-2009

CVE	CVE Description	Reference
CVE-2009-2023	SQL injection vulnerability in index.php in Shop-Script Pro 2.12, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the current_currency parameter.	https://www.exploit-db.com/exploits/8906

# CVE-2008

CVE	CVE Description	Reference
CVE-2008-2023	Multiple SQL injection vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to execute arbitrary SQL commands via the (1) invisible and (2) timeoffset parameters to profile/controlpanel.asp and the (3) attachmentid parameter to forums/attach-file.asp.	https://www.exploit-db.com/exploits/5507
CVE-2008-0670	SQL injection vulnerability in index.php in the Noticias (com_noticias) 1.0 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a detalhe action.	https://www.exploit-db.com/exploits/5081
CVE-2008-0772	SQL injection vulnerability in index.php in the com_doc component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the sid parameter in a view task.	https://www.exploit-db.com/exploits/5080
CVE-2008-0721	SQL injection vulnerability in index.php in the Sermon (com_sermon) 0.2 component for Mambo allows remote attackers to execute arbitrary SQL commands via the gid parameter.	https://www.exploit-db.com/exploits/5076
CVE-2008-0719	SQL injection vulnerability in customer_testimonials.php in the Customer Testimonials 3 and 3.1 Addon for osCommerce Online Merchant 2.2 allows remote attackers to execute arbitrary SQL commands via the testimonial_id parameter.	https://www.exploit-db.com/exploits/5075
CVE-2008-7242	Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the (1) search, (2) "a," (3) messagesubject, and (4) messagebody parameters to certain pages as reachable from manager/index.php; (5) highlight, (6) id, (7) email, (8) name, and (9) parent parameters to index.php; and the (10) docgrp and (11) moreResultsPage parameters to index-ajax.php.	https://www.exploit-db.com/exploits/31120

# CVE-2001

CVE	CVE Description	Reference
CVE-2001-1524	Cross-site scripting (XSS) vulnerability in PHP-Nuke 5.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) uname parameter in user.php, (2) ttitle, letter and file parameters in modules.php, (3) subject, story and storyext parameters in submit.php, (4) upload parameter in admin.php and (5) fname parameter in friend.php.	https://www.exploit-db.com/exploits/21166

# Error code 502

This issue indicates that the Web Application Firewall (WAF) cannot connect to the backend application server. To resolve this, verify the protocol used by the WAF to reach the backend server or whitelist the WAF IPs on the backend server. Follow these steps to change the protocol: 1. Log in to the Prophaze Dashboard. 2. Navigate to the Settings tab. 3. Click the edit icon next to the domain name for which you want to make changes. 4. Check the endpoint and protocol. Make sure to save any changes to apply the new settings.

# Error code 504

A gateway timeout error typically occurs when the Web Application Firewall (WAF) takes longer than expected to connect to the backend server. This can happen, for instance, if a user is downloading a large file, which may result in a longer connection time to the site. Follow these steps to change the protocol: 1. Log in to the Prophaze Dashboard. 2. Navigate to the Settings tab. 3. Click the edit icon next to the domain name for which you want to make changes. 4. Increase the below timeouts value. # Error Code 503 In this case, the Web Application Firewall (WAF) is unable to reach the backend server. A probable cause for this issue is that the backend server is down for maintenance. To resolve this issue: 1. Check Server Status: Verify if the backend server is undergoing maintenance or experiencing downtime. 2. Monitor Maintenance Schedules: Ensure you are aware of any scheduled maintenance that could impact server availability. 3. Bot Mitigation: If Bot Mitigation is enabled, server or API requests to the application may be blocked by the WAF. To prevent this, whitelist the source IPs under the "Allowed IPs" section in the Bot Mitigation module.

# Error Code 403

A 403 Forbidden error indicates that the user is prohibited from accessing the website. This often results from custom rules implemented by the user. For example, if a custom rule is set to block access from the USA, and a user tries to access the site from the USA, they will encounter a 403 Forbidden error. To resolve this issue: 1. Review Custom Rules: Check the custom rules configured on your site. 2. Adjust Settings: Modify or remove any rules that are unnecessarily restrictive. Ensure that your custom rules are appropriately set to balance security and accessibility. # Unknown Error If you are not encountering any of the errors mentioned above, please follow these steps: 1. Bypass the WAF and verify if the issue persists. 2. Upload the complete SSL certificate chain to the Prophaze Dashboard. 3. Whitelist the Prophaze WAF IPs within your infrastructure.