PT-2015-7613

Name of the Vulnerable Software and Affected Versions Collne Welcart plugin versions prior to 1.5.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the searchcolumn or switch parameter in the admin.php file. Recommendations For...

CVE-2015-7791: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin.php in the Collne Welcart plugin before 1.5.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 searchcolumn or 2 switch parameter...

Ovidentia bulletindoc Module 2.9 - Multiple Remote File Inclusions

Title: Ovidentia Module bulletindoc 2.9 Multiple Remote File Inclusion Vulnerabilities Author: bd0rk eMail: bd0rkathackermail.com Twitter: twitter.com/bd0rk Tested on: Ubuntu-Linux Download:...

POLLSolved 1.5.2 SQL Injection / Authentication Bypass

Exploit Title : POLLSolved Authentication Bypass Exploit Author : Persian Hack Team Vendor Homepage : http://www.usolved.net/ Google Dork : intitle:POLLSolved Date: 2015/11/12 Version : v1.5.2 PoC: To bypass the login page enter '=' 'or' for username and password input. Login And Add Your Poll D:...

Quick.Cart 6.6 Cross Site Scripting

Security Advisory - Curesec Research Team 1. Introduction Affected Product: Quick.Cart 6.6 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: XSS Remote Exploitable: Yes Reported to vendor: 09/07/2015 Disclosed to public: 10/07/2015 Release mode:...

PT-2015-7576

Name of the Vulnerable Software and Affected Versions Pie Register plugin versions prior to 2.0.19 Description The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the select invitaion code bulk option or invi del id parameter in the...

mcGallery 'lang' Parameter Multiple Cross Site Scripting Vulnerabilities

背景： PhpForums.net mcGallery是一款网站图片管理脚本工具。 类型： xss 影响： 可注入任意web脚本或HTML 分析： PhpForums.net mcGallery 1.1版本中存在多个跨站脚本攻击漏洞。远程攻击者可以借助对 1admin.php, 2index.php, 3sess.php, 4stats.php, 5detail.php, 6resize.php, 7show.php的lang参数，注入任意web脚本或HTML。...

PT-2015-7129

Name of the Vulnerable Software and Affected Versions Google Analyticator plugin versions prior to 6.4.9.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters in the google-analyticator page to wp-admin/admin.php. The vulnerable parameter...

Nibbleblog 4.0.3 admin.php CSRF

No description provided by source. this." document.getElementById"myForm".submit;...

PT-2015-7426

Name of the Vulnerable Software and Affected Versions Nibbleblog versions prior to 4.0.5 Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be achieved through two main actions: 1 creating a post via a new simple action to...

PT-2015-7425

Name of the Vulnerable Software and Affected Versions Contact Form Generator plugin versions 2.0.1 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including creating, updating, or deleting fields, forms, or templates, ...

CVE-2015-6966: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that 1 create a post via a newsimple action to admin.php or 2 conduct cross-site scripting XSS attacks via the content parameter i...

CVE-2015-6965: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 create a field, 2 update a field, 3 delete a field, 4 create a form, 5 update a...

PT-2015-7417

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.0.2 Description The issue allows remote administrators to execute arbitrary SQL commands. This is possible when the "Use Tokens for Comment Moderation" feature is enabled. The serendipityid parameter in the...

WDS CMS /wds_news/article.php SQL注入

Exploit : http:// Target/wdsnews/article.php?ID=-1+union+select+1,groupconcatusername,0x3a,password,3,4,5,6,7,8,9,10+from+cmsadmin-- Upload Shell : http://Target/wdsnews/admin.php?mode=listfile Shell Path : http://Target/wdsnews/filer/shell.php...

Cross site scripting

Cross-site scripting XSS vulnerability in jquery.lightbox-0.5.min.js in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified input to admin.php...

CVE-2015-2982

Cross-site scripting XSS vulnerability in jquery.lightbox-0.5.min.js in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified input to admin.php...

CVE-2015-2982

Summary (CVE-2015-2982) : The PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone (Free) versions 1.0.1 and earlier is affected by a cross-site scripting (XSS) vulnerability in the jquery.lightbox-0.5.min.js path, caused by inadequate input filtering in admin.php. A remote authenticat...

PT-2015-6028

Name of the Vulnerable Software and Affected Versions PHP Kobo Photo Gallery CMS version 1.0.1 Free and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML via unspecified...

PT-2015-6029

Name of the Vulnerable Software and Affected Versions PHP Kobo Photo Gallery CMS versions 1.0.1 Free and earlier Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of arbitrary users. This occurs in the admin.php file. Recommendation...