Category: Security

[webapps] Dolibarr 11.0.3 – Persistent Cross-Site Scripting

[local] Druva inSync Windows Client 6.6.3 – Local Privilege Escalation

[webapps] Gym Management System 1.0 – Unauthenticated Remote Code Execution

[remote] WebLogic Server – Deserialization RCE – BadAttributeValueExpException (Metasploit)

[dos] AbsoluteTelnet 11.21 – 'Username' Denial of Service (PoC)

[webapps] forma.lms 5.6.40 – Cross-Site Request Forgery (Change Admin Email)

[webapps] CraftCMS 3 vCard Plugin 1.0.0 – Remote Code Execution

[webapps] qdPM 9.1 – 'cfg[app_app_name]' Persistent Cross-Site Scripting

[webapps] Victor CMS 1.0 – 'cat_id' SQL Injection

[webapps] php-fusion 9.03.50 – 'ctype' SQL Injection