Sahil Ojha

19 exploits Active since May 2023
CVE-2023-34839 NOMISEC MEDIUM WRITEUP
Issabel Pbx - CSRF
A Cross Site Request Forgery (CSRF) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application.
5 stars
CVSS 6.8
CVE-2023-31703 NOMISEC CRITICAL WRITEUP
Microworld Technologies eScan <14.0.1400.2281 - XSS
Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter.
3 stars
CVSS 9.0
CVE-2023-37599 NOMISEC HIGH WRITEUP
Issabel Pbx - Exposure to Wrong Actor
An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory
2 stars
CVSS 7.5
CVE-2023-31702 NOMISEC HIGH WRITEUP
MicroWorld eScan Management Console <14.0.1400.2281 - SQL Injection
SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.
2 stars
CVSS 7.2
CVE-2023-37596 NOMISEC HIGH WRITEUP
Issabel Pbx - CSRF
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via a crafted script to the deleteuser function.
1 stars
CVSS 8.1
CVE-2023-37597 NOMISEC HIGH WRITEUP
Issabel Pbx - CSRF
Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete user grouplist function.
1 stars
CVSS 8.1
CVE-2023-37598 NOMISEC MEDIUM WRITEUP
Issabel Pbx - CSRF
A Cross Site Request Forgery (CSRF) vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function.
1 stars
CVSS 4.5
CVE-2023-37189 NOMISEC MEDIUM WRITEUP
Issabel Pbx - XSS
A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module.
1 stars
CVSS 4.8
CVE-2023-37190 NOMISEC MEDIUM WRITEUP
Issabel Pbx - XSS
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Virtual Fax Name and Caller ID Name parameters under the New Virtual Fax feature.
1 stars
CVSS 4.8
CVE-2023-37191 NOMISEC MEDIUM WRITEUP
Issabel Pbx - XSS
A stored cross-site scripting (XSS) vulnerability in Issabel issabel-pbx v.4.0.0-6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Group and Description parameters.
1 stars
CVSS 4.8
CVE-2023-34837 NOMISEC MEDIUM WRITEUP
Escanav Escan Management Console - XSS
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath.
1 stars
CVSS 5.4
CVE-2023-33730 NOMISEC CRITICAL WRITEUP
Escanav Escan Management Console - Cleartext Transmission
Privilege Escalation in the "GetUserCurrentPwd" function in Microworld Technologies eScan Management Console 14.0.1400.2281 allows any remote attacker to retrieve password of any admin or normal user in plain text format.
1 stars
CVSS 9.8
CVE-2023-33731 NOMISEC MEDIUM WRITEUP
Microworld Technologies eScan <14.0.1400.2281 - XSS
Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the URL directly.
1 stars
CVSS 6.1
CVE-2023-33732 NOMISEC MEDIUM WRITEUP
Microworld Technologies eScan mgmt console 14.0.1400.2281 - XSS
Cross Site Scripting (XSS) in the New Policy form in Microworld Technologies eScan management console 14.0.1400.2281 allows a remote attacker to inject arbitrary code via the vulnerable parameters type, txtPolicyType, and Deletefileval.
1 stars
CVSS 6.1
CVE-2023-34835 NOMISEC MEDIUM WRITEUP
Escanav Escan Management Console - XSS
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete_file parameter.
1 stars
CVSS 5.4
CVE-2023-34836 NOMISEC MEDIUM WRITEUP
Escanav Escan Management Console - XSS
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Dtltyp and ListName parameters.
1 stars
CVSS 5.4
CVE-2023-34838 NOMISEC MEDIUM WRITEUP
Escanav Escan Management Console - XSS
A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Description parameter.
1 stars
CVSS 5.4
CVE-2023-31703 EXPLOITDB CRITICAL text WORKING POC
Microworld Technologies eScan <14.0.1400.2281 - XSS
Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter.
CVSS 9.0
CVE-2023-31702 EXPLOITDB HIGH text WRITEUP
MicroWorld eScan Management Console <14.0.1400.2281 - SQL Injection
SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.
CVSS 7.2