Nguyen-Trung-Kien

21 exploits Active since Jan 2022
CVE-2021-46458 WRITEUP HIGH WORKING POC
Victor CMS v1.0 - SQL Injection via post_title Parameter
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post. This vulnerability can be exploited through a crafted POST request via the post_title parameter.
CVSS 7.5
CVE-2021-46459 WRITEUP HIGH WRITEUP
Victor CMS 1.0 - SQL Injection via admin/users.php user_name Parameter
Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user. These vulnerabilities can be exploited through a crafted POST request via the user_name, user_firstname,user_lastname, or user_email parameters.
CVSS 7.5
CVE-2022-24227 WRITEUP MEDIUM WORKING POC
BoltWire 7.10 and 8.00 - Cross-Site Scripting via Name and Lastname Parameters
A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the name and lastname parameters.
CVSS 6.1
CVE-2022-24226 WRITEUP HIGH WORKING POC
Hospital Management System v4.0 - SQL Injection
Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.
CVSS 7.5
CVE-2022-24227 WRITEUP MEDIUM STUB
BoltWire 7.10 and 8.00 - Cross-Site Scripting via Name and Lastname Parameters
A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the name and lastname parameters.
CVSS 6.1
CVE-2022-24585 WRITEUP MEDIUM WORKING POC
PluXml 5.8.7 - Stored Cross-Site Scripting via Author Parameter
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter.
CVSS 5.4
CVE-2022-24586 WRITEUP MEDIUM WORKING POC
PluXml 5.8.7 - Stored Cross-Site Scripting via Categories Content and Thumbnail Parameters
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters.
CVSS 5.4
CVE-2022-24587 WRITEUP MEDIUM WRITEUP
PluXml 5.8.7 - Stored Cross-Site Scripting in Media Management Component
A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML.
CVSS 5.4
CVE-2022-24588 WRITEUP MEDIUM WORKING POC
Flatpress v1.2.1 - Stored Cross-Site Scripting via SVG File Upload
Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.
CVSS 5.4
CVE-2022-24589 WRITEUP MEDIUM WORKING POC
burden v3.0 - Stored Cross-Site Scripting in Add Category Function via Task Parameter
Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task parameter.
CVSS 6.1
CVE-2022-24590 WRITEUP MEDIUM WORKING POC
BackdropCMS 1.21.1 - Stored Cross-Site Scripting in Add Link Function
A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.
CVSS 5.4
CVE-2021-46253 WRITEUP MEDIUM WORKING POC
Anchor CMS 0.12.7 - Stored Cross-Site Scripting in Create Post Function
A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML.
CVSS 5.4
CVE-2021-46458 WRITEUP HIGH WRITEUP
Victor CMS v1.0 - SQL Injection via post_title Parameter
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post. This vulnerability can be exploited through a crafted POST request via the post_title parameter.
CVSS 7.5
CVE-2021-46459 WRITEUP HIGH WRITEUP
Victor CMS 1.0 - SQL Injection via admin/users.php user_name Parameter
Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user. These vulnerabilities can be exploited through a crafted POST request via the user_name, user_firstname,user_lastname, or user_email parameters.
CVSS 7.5
CVE-2022-24226 WRITEUP HIGH STUB
Hospital Management System v4.0 - SQL Injection
Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.
CVSS 7.5
CVE-2022-24585 WRITEUP MEDIUM WRITEUP
PluXml 5.8.7 - Stored Cross-Site Scripting via Author Parameter
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter.
CVSS 5.4
CVE-2022-24586 WRITEUP MEDIUM WRITEUP
PluXml 5.8.7 - Stored Cross-Site Scripting via Categories Content and Thumbnail Parameters
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters.
CVSS 5.4
CVE-2022-24587 WRITEUP MEDIUM STUB
PluXml 5.8.7 - Stored Cross-Site Scripting in Media Management Component
A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML.
CVSS 5.4
CVE-2022-24588 WRITEUP MEDIUM STUB
Flatpress v1.2.1 - Stored Cross-Site Scripting via SVG File Upload
Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.
CVSS 5.4
CVE-2022-24589 WRITEUP MEDIUM WRITEUP
burden v3.0 - Stored Cross-Site Scripting in Add Category Function via Task Parameter
Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task parameter.
CVSS 6.1
CVE-2022-24590 WRITEUP MEDIUM WRITEUP
BackdropCMS 1.21.1 - Stored Cross-Site Scripting in Add Link Function
A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.
CVSS 5.4