>> TAG: #0day

TeamSpeak 3.5.6 – Insecure File Permissions

Network Video Recorder NVR304-16EP – Reflected Cross-Site Scripting (XSS) (Unauthenticated)

WordPress Plugin Error Log Viewer 1.1.1 – Arbitrary File Clearing (Authenticated)

Subrion CMS 4.2.1 – Cross Site Request Forgery (CSRF) (Add Amin)

Accounting Journal Management System 1.0 – ‘id’ SQLi (Authenticated)

Kyocera Command Center RX ECOSYS M2035dn – Directory Traversal File Disclosure (Unauthenticated)

WordPress Plugin Contact Form Builder 1.6.1 – Cross-Site Scripting (XSS)

Cain & Abel 4.9.56 – Unquoted Service Path

Home Owners Collection Management System 1.0 – Account Takeover (Unauthenticated)