1259 matches found
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the adminid, newpass1, and newpass2 parameters...
CVE-2008-5568
Cross-site request forgery CSRF vulnerability in admin/settings.php in IPN Pro 3 1.44 and earlier allows remote attackers to change the admin password via a logout action in conjunction with the adminid, newpass1, and newpass2 parameters...
CVE-2008-5565
CVE-2008-5565 is a CSRF vulnerability in DL PayCart 1.34 and earlier, where an attacker can cause an admin password change by triggering a logout action with the parameters NewAdmin, NewPass1, and NewPass2 in admin/settings.php. Root cause is CSRF in the admin settings workflow; impact is partial...
YourFreeWorld Classifieds - category SQL Injection
YourFreeWorld Classifieds - category SQL Injection Classifieds category Remote SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.yourfreeworld.com/script/classifieds.php DorK : inurl:classifieds/view.php?category= Exploit :...
YourFreeWorld Forced Matrix Script - SQL Injection
YourFreeWorld Forced Matrix Script - SQL Injection Forced Matrix Script id Remote SQL Injection Vulnerability Author: Hussin X Home : www.IQ-TY.com & www.TrYaG.cc script : http://www.yourfreeworld.com/script/subscriptionforcedmatrix.php DorK : inurl:"tr1.php?id=" Forced Matrix Exploit :...
classifieds-sql.txt
|| | | Classifieds category Remote SQL Injection Vulnerability | | |---------------------Hussin X----------------------| | | Author: Hussin X | | Home : www.tryag.cc/cc | | email: darkangelg85atYahooDoTcom | | | | | | | script http://www.yourfreeworld.com/script/classifieds.php | | DorK :...
Multiple Century Systems routers vulnerable to cross-site request forgery
Overview The web interface in multiple Century Systems routers is vulnerable to cross-site request forgery. Multiple Century Systems Co., Ltd. routers provide a web-based interface for users to configure the routers. The web interface is vulnerable to cross-site request forgery. Hirotaka Katagiri...
Comparison Engine Power 1.0 - Blind SQL Injection
!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 print " \n"; print " VIVA ISLAME VIVA ISLAME \n"; print " VIVA ISLAME VIVA ISLAME \n"; print " \n"; print " Comparison Engine Power 1.0 Blind SQL Injection Exploit \n"; print " \n"; print " Author: Mr.SQL \n"; print " EMAIL :...
AirStation series and BroadStation series vulnerable to cross-site request forgery
Overview Buffalo's AirStation Series and BroadStation Series routers are vulnerable to cross-site request forgery. Buffalo's AirStation series and BroadStation series routers have a web administration interface that can be accessed from a web browser to configure their functional settings. The we...
Multiple Yamaha routers vulnerable to cross-site request forgery
Overview The web interface in multiple Yamaha routers is vulnerable to cross-site request forgery. Multiple Yamaha routers provide a web-based interface for users to configure the settings of the routers. The web interface is vulnerable to cross-site request forgery. Impact If the administrator...
CVE-2008-1334
CVE-2008-1334 affects the BT Home Hub router (and related Thomson/Alcatel SpeedTouch components) where an authentication bypass is possible by placing a character at the end of PATH_INFO. The vulnerability lets remote attackers bypass authentication and read/modify administrative settings or init...
CVE-2007-6494
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/addreseller.asp with a username in the reseller parameter, followed by a request to AdminSettings/displays.asp with the DecideAction and ChangeSkin parameters...
Cross site request forgery (csrf)
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to enable or disable "pay type" via a request to adminsettings/choosetranstype.asp...
CVE-2007-6501
Unspecified vulnerability in Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote authenticated users to enable or disable "pay type" via a request to adminsettings/choosetranstype.asp...
e107 0.7.8 - photograph Arbitrary File Upload
e107 0.7.8 - photograph Arbitrary File Upload / \ / \ | | | | | | | | | | | / | | | | | | | ' / | | ' \ / \ | | | | || | || | | | \ | | | | / | , |/ /|| ||| |||| / | |/ INFO: Program Title e107 = 0.7.8 - Arbitrary File Upload Description "e107 is a content management system written in PHP...
e107 <= 0.7.8 (photograph) Arbitrary File Upload Vulnerability
Exploit for unknown platform in category web applications ============================================================== e107 = 0.7.8 photograph Arbitrary File Upload Vulnerability ============================================================== / \ / \ | | | | | | | | | | | / | | | | | | | ' / | |...
Remote file inclusion
Multiple PHP remote file inclusion vulnerabilities in Supasite 1.23b allow remote attackers to execute arbitrary PHP code via a URL in the supadbpath parameter to 1 commonfunctions.php, 2 adminauthcookies.php, 3 adminmods.php, 4 adminnews.php, 5 admintopics.php, 6 adminusers.php, 7...
CVE-2007-2082
CVE-2007-2082 describes a direct static code injection vulnerability in admin/settings.php for MyBlog 0.9.8 and earlier. The issue allows remote authenticated admin users to inject arbitrary PHP code via the content parameter, which can be executed by accessing index.php. A separate vulnerability...