WordPress SS Downloads Plugin <= 1.4 - XSS

Because of this vulnerability in templates/download.php, attackers can inject arbitrary web script or HTML via the "title" parameter. Solution Update the plugin...

WordPress SCv1 Local File Disclosure

Title : Wordpress SCv1 Theme Local File Disclosure + Discovered By : Medrik + CMS Home-Page : http://wordpress.org + Found Date : 2014-06-10 + Tested On : Windows This is LFD Vulnerability In : File : download.php Parameter : file Vulnerability Locate :...

NS_ASG 6.3 /commonplugin-Download.php 任意文件下载漏洞

No description provided by source...

WordPress Theme LineNity 1.20 - Local File Inclusion

WordPress Theme LineNity 1.20 - Local File Inclusion + Local File Inclusion in WordPress Theme LineNity + Date: 13/04/2014 + Risk: High + Author: Felipe Andrian Peixoto + Vendor Homepage: http://themeforest.net/item/linenity-clean-responsive-wordpress-magazine/4417803 + Contact:...

Sql injection

SQL injection vulnerability in download.php in Horizon Quick Content Management System QCMS 4.0 and earlier allows remote to execute arbitrary SQL commands via the category parameter...

CVE-2013-7139

SQL injection vulnerability in download.php in Horizon Quick Content Management System QCMS 4.0 and earlier allows remote to execute arbitrary SQL commands via the category parameter...

NITC 3.21 /download.php 任意文件下载漏洞

No description provided by source...

Dedecms v57 sp1 plus/download.php SQL注入漏洞

起因是全局变量$GLOBALS可以被任意修改，随便看了下，漏洞一堆，我只找了一处。 codeinclude/dedesql.class.php ifisset$GLOBALS'arrs1' $v1 = $v2 = ''; for$i=0;isset$arrs1$i;$i++ $v1 .= chr$arrs1$i; for$i=0;isset$arrs2$i;$i++ $v2 .= chr$arrs2$i; //解码ascii $GLOBALS$v1 .= $v2; //注意这里不是覆盖，是+ function SetQuery$sql $prefix="@"; $sql =...

Manhali 1.8 - Local File Inclusion

Exploit Title: Manhali v1.8 Local File Inclusion Vulnerability Date: 20/09/2012 Author: L0n3ly-H34rT Contact: [email protected] My Site: http://se3c.blogspot.com/ Vendor Link: http://www.manhali.com/ Software Link: http://sourceforge.net/projects/manhali/files/manhali1.8.zip/download Versio...

SaltOS - download.php Cross-Site Scripting

SaltOS - download.php Cross-Site Scripting source: https://www.securityfocus.com/bid/55117/info SaltOS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of...

Rama Zeiten CMS Remote File Disclosure Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

GNUBoard 4.34.20 - download.php HTML Injection

GNUBoard 4.34.20 - download.php HTML Injection source: https://www.securityfocus.com/bid/52622/info Gnuboard is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script co...

CVE-2012-0980

SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter...

TYPO3 'download.php' Local File Disclosure Vulnerability

TYPO3 is prone to a local file disclosure vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...

Typo3 - File Disclosure

Typo3 - File Disclosure | | | ||\ || || || | \ // | | | || \ || || || | |\ //| | | \ | | |/ / | | || \ || || || | | \ // | | | \ | | / / | | || \ || || || | | \ // | | | | | | | /'\ / / | | || \ || || || | | \ // | | | | | \ \ / / / | | || \ || |||| | | \// | | | | | | | \ \ / / | |...

PixelGems <= Remote (File Disclosure/LFI) Exploit

Exploit for php platform in category web applications PixelGems Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 + Site : 1337day.com 0 1 + Support e-mail : submitat1337day.com 1 0 0 1 1 0 I'm KnocKout member from Inj3ct0r Team 1 1 0...

CVE-2011-1669

The CVE-2011-1669 entry corresponds to a directory traversal (Local File Inclusion) vulnerability in the WordPress WP Custom Pages plugin, affecting version 0.5.0.1. According to connected sources, the flaw resides in wp-download.php and allows remote attackers to read arbitrary server files by s...

Multiple Vulnerabilities in Eleanor CMS

High-Tech Bridge SA Security Research Lab has discovered vulnerabilities in Eleanor CMS which could be exploited to perform cross-site scripting and SQL injection attacks. 1 Cross-site scripting XSS vulnerability in Eleanor CMS The vulnerability exists due to input sanitation error in the...

Seo Panel 2.1.0 - Critical File Disclosure

Title: Seo Panel 2.1.0 - Critical File Disclosure Body: Seo Panel - Critical File Disclosure http://www.exploit-db.com/finding-0days-in-web-applications/ Versions Affected: 2.1.0 previous versions were not checked. Info: A complete open source seo control panel for managing search engine...

SQL injection vulnerability in e107

Vulnerability ID: HTB22603 Reference: http://www.htbridge.ch/advisory/sqlinjectionvulnerabilityine1071.html Product: e107 Website System Vendor: e107 http://www.e107.org/ Vulnerable Version: 0.7.23 and Probably Prior Versions Vendor Notification: 03 September 2010 Vulnerability Type: SQL Injectio...