Page 3 - Software Link News Today

# Exploit Title: WP Plugins KiviCare 3.2.0 - Reflected Cross-Site Scripting# Date: 03-10-2023# Exploit Author: Arvandy# Software Link: https://wordpress.org/plugins/kivicare-clinic-management-system/# Vendor Homepage: https://kivicare.io/# Version: 3.2.0# Tested on: Windows, Linux# CVE: CVE-2023-2624# Product DescriptionKiviCare is the most affordable self-hosted clinic and patient management system based on the WordPress platform. Set up your online clinic in no time.

# Exploit Title: WP Plugins Contact Form Generator 2.5.5 - Reflected Cross-Site Scripting# Date: 03-10-2023# Exploit Author: Arvandy# Software Link: https://wordpress.org/plugins/contact-form-generator/# Vendor Homepage: https://www.creative-solutions.net/# Version: 2.5.5 # Tested on: Windows, Linux# CVE: CVE-2023-37988# Product DescriptionContact Form Generator is a powerful contact form builder for WordPress! It is structured for creating Contact Forms, Application Forms, Reservation

# Exploit Title: Free and Open Source Inventory Management System 1.0 - Unauthenticated SQL Injection# Exploit Author: Sefa Ozan# Date: 16/09/2023# Vendor: MAYURIK# Vendor Homepage: https://mayurik.com/# Software Link: https://www.sourcecodester.com/php/16741/free-and-open-source-inventory-management-system-php-source-code.html# Tested on: Windows 10 Pro & Ubuntu 22.04## Description:The `pid[]` parameter is vulnerable to Time Based SQL injection attacks. To prove the existence of the vulnera...

# Exploit Title: Academy LMS 6.2 - Reflected XSS# Exploit Author: CraCkEr# Date: 29/08/2023# Vendor: Creativeitem# Vendor Homepage: https://creativeitem.com/# Software Link: https://demo.creativeitem.com/academy/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4973# CWE: CWE-79 - CWE-74 - CWE-707## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushkaCryptoJob (Twitter)

# Exploit Title: Academy LMS 6.2 - SQL Injection# Exploit Author: CraCkEr# Date: 29/08/2023# Vendor: Creativeitem# Vendor Homepage: https://creativeitem.com/# Software Link: https://demo.creativeitem.com/academy/# Tested on: Windows 10 Pro# Impact: Database Access# CVE: CVE-2023-4974# CWE: CWE-89 / CWE-74 / CWE-707## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushkaCryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionSQL injection attacks

#Exploit Title: Kingo ROOT 1.5.8 - Unquoted Service Path#Date: 8/22/2023#Exploit Author: Anish Feroz (ZEROXINN)#Vendor Homepage: https://www.kingoapp.com/#Software Link: https://www.kingoapp.com/android-root/download.htm#Version: 1.5.8.3353#Tested on: Windows 10 Pro-------------Discovering Unquoted Path--------------C:UsersAnish>sc qc KingoSoftService[SC] QueryServiceConfig SUCCESSSERVICE_NAME: KingoSoftServiceTYPE : 110 WIN32_OWN_PROCESS (interactive)START_TYPE : 2 AUTO_STARTERROR_CONTROL : ...

# Exploit Title: CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')# Date: 2023/08/18# CVE: CVE-2023-38911# Exploit Author: Daniel González# Vendor Homepage: https://www.cszcms.com/# Software Link: https://github.com/cskaza/cszcms# Version: 1.3.0# Tested on: CSZ CMS 1.3.0# Description:# CSZ CMS 1.3.0 is affected by a cross-site scripting (XSS) feature that allows attackers to execute arbitrary web scripts or HTML

# Exploit Title: PlayTube 3.0.1 - Redirect Information Disclosure# Exploit Author: CraCkEr# Date: 19/08/2023# Vendor: PlayTube# Vendor Homepage: https://playtubescript.com/# Software Link: https://demo.playtubescript.com/# Tested on: Windows 10 Pro# Impact: Sensitive Information Leakage# CVE: CVE-2023-4714# CWE: CWE-200 - CWE-284 - CWE-266## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushkaCryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionInforma...

# Exploit Title: GOM Player 2.3.90.5360 - Remote Code Execution (RCE)# Date: 26.08.2023# Author: M. Akil Gündoğan# Contact: https://twitter.com/akilgundogan# Vendor Homepage: https://www.gomlab.com/gomplayer-media-player/# Software Link: https://cdn.gomlab.com/gretech/player/GOMPLAYERGLOBALSETUP_NEW.EXE# Version: 2.3.90.5360 # Tested on: Windows 10 Pro x64 22H2 19045.3324# PoC Video: https://www.youtube.com/watch?v=8d0YUpdPzp8# Impacts: GOM player has been downloaded 63,952,102 times according...

# Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS# Exploit Author: CraCkEr# Date: 20/08/2023# Vendor: SPA-Cart# Vendor Homepage: https://spa-cart.com/# Software Link: https://demo.spa-cart.com/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4547# CWE: CWE-79 - CWE-74 - CWE-707## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushkaCryptoJob