CVE-2014-4575

Cross-site scripting XSS vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter...

WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress wpsf-js plugin, SQL Injection Date: 2011-09-25 Author: cheki Version:3.2.1 Tested on:linux Used: sqlmap SQL Injection http://target/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1 Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND...

WordPress Js-appointment plugin <= 1.5 - SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Js-appointment plugin = 1.5 SQL Injection Vulnerability Date: 2011-08-26 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/js-appointment.1.5.zip Version: 1.5 tested Note:...

WeBid 1.0.2 persistent XSS via SQL Injection

No description provided by source. Exploit Title: presistent XSS through SQLi WeBid 1.0.2 Google Dork: powered by WeBid Date: 15-06-2011 Author: Saif El-Sherei Software Link: http://sourceforge.net/projects/simpleauction/ Version: 1.0.2 Tested on: Firefox 4, XAMPP Info: Open source php/mysql full...

Alt-N MDaemon 13.0.3 and 12.5.6 Email Body HTML/JS Injection Vulnerability

No description provided by source. ============================================================== Alt-N MDaemon Email Body HTML/JS Injection Vulnerability ============================================================== Software: Alt-N MDaemon v13.0.3 and prior versions Vendor: http://www.altn.com/...

CVE-2014-4575: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/window.php in the Wikipop plugin 2.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter...

PT-2014-5989

Name of the Vulnerable Software and Affected Versions Wikipop plugin versions 2.0 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the s parameter in the js/window.php file. Recommendations For Wikipop plugin versions 2.0 and...

WordPress Wikipop Plugin <= 2.0 - XSS

Because of this vulnerability in js/window.php, the attackers can inject arbitrary web script or HTML via the "s" parameter. Solution Update the plugin...

WordPress SnapApp Plugin <= 1.5 - Multiple XSS

Because of these multiple vulnerabilities in js/button-snapapp.php, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress Appointment Scheduler Plugin <= 1.5 - XSS

Because of this vulnerability in js/test.php, the attackers can inject arbitrary web script or HTML via the lang parameter. Solution Update the plugin...

Microsoft Internet Explorer Js::PathTypeHandlerBase Improper Indexing Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Nosql-Exploitation-Framework - A FrameWork For NoSQL Scanning and Exploitation Framework

A FrameWork For NoSQL Scanning, Enumeration and Exploitation. NoSQL Databases are schema less databases. They were invented to store data easily and flexibly. NoSQL Databases have gained popularity and its security has always been under the scanner. The NoSQL Exploitation Framework focuses...

PT-2014-1062

Name of the Vulnerable Software and Affected Versions Internet Explorer affected versions not specified Description The issue is caused by an error in the Js::PathTypeHandlerBase::SetProperty function due to improper indexing when certain arguments are input, allowing an attacker to execute...

程氏舞曲CMS储存型 xss（5）

简要描述： rt，swf啊。。 详细说明： 上传视频处 。对于外部swf文件 过分信任 可插入 如下代码 构造 恶意的 swf 执行 js 像这样 alert 这是 获取cookie的swf代码 package import flash.external.ExternalInterface; import flash.display.Sprite; import flash.display.Sprite; import flash.events.Event; import flash.net.URLLoader; import flash.net.URLRequest; import...

ThinkPHP官网存储型XSS

简要描述： 对部分内容处理不当导致用户可在帖子中植入恶意js代码进而进行跨站脚本攻击 详细说明： 由于对附件名称没有进行escape，导致用户可以通过修改文件名为恶意的HTML代码进一步将其植入到帖子中，下面是官方讨论板块演示： 漏洞证明： 一旦恶意代码被植入成功后，所有浏览该页面的用户都会受到跨站脚本攻击。...

IPSwitch IMail Server WEB client 12.4 persistent XSS

Exploit for windows platform in category web applications Exploit Title: IPSwitch IMail Server WEB client 12.4 persistent XSS Google Dork: Date: 3 june 2014 Exploit Author: Peru GoSecure! Vendor Homepage: www.ipswitch.com Software Link: http://www.imailserver.com/try/ Version: Tested on 12.3 and...

Taobao decoration can reference external js file-bug warning-the black bar safety net

Taobao decoration page for the js filter is not strict you can use user reference to an external js file, you can obtain other Taobao user cookies, modify your own shop reviews, baby sell number and the like. In Taobao decoration page that has a background image uploaded, as long as firebug for...

CVE-2014-0200

The Red Hat Enterprise Virtualization Manager reports rhevm-reports package before 3.3.3-1 uses world-readable permissions on the datasource configuration file js-jboss7-ds.xml, which allows local users to obtain sensitive information by reading the file...

PT-2014-3530 · Red Hat · Rhevm-Reports

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager reports rhevm-reports versions prior to 3.3.3-1 Description: The issue allows local users to obtain sensitive information by reading a configuration file due to world-readable permissions. The file in...

CVE-2014-0200: Undefined Security Weakness

The Red Hat Enterprise Virtualization Manager reports rhevm-reports package before 3.3.3-1 uses world-readable permissions on the datasource configuration file js-jboss7-ds.xml, which allows local users to obtain sensitive information by reading the file...