Malware exploit: Zskimmer

Type: SQLi Vuln: http://localhost/process.php?xy=2...

Schoolhos CMS 'process.php' page remote code execution vulnerability

Schoolhos CMS is a free and open source content management system. A remote code execution vulnerability exists in the process.php page of Schoolhos CMS version 2.29, which can be exploited by an attacker to execute arbitrary code in the context of an affected application, potentially also...

Schoolhos CMS 2.29 - Remote Code Execution / SQL Injection

\x0d\x0a-----------------------------26518470919255\x0d\x0a\x0d\x0a' \ 'http://HOST/PATH/elearningku/proses.php?pilih=guru&untukdi=upload' php file can be ccessed via : http://HOST/PATH/file/mater...

macinside.info XSS vulnerability

Vulnerable URL: http://www.macinside.info/process.php?name=ubd" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 622069 VIP website status:| No Check macinside.info SSL connection:|...

CVE-2014-4538

Cross-site scripting XSS vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the query parameter...

WordPress Malware Finder Plugin <= 1.1 - XSS

Because of this vulnerability in process.php, the attackers can inject arbitrary web script or HTML via the "query" parameter. Solution Update the plugin...

EPESI CRM 1.5.5 Cross Site Scripting

============================================================== Title ...| EPESI CRM vulnerable to persistent XSS Version .| epesi-1.5.5-20140113.zip Date ....| 27.02.2014 Found ...| HauntIT Blog Home ....| http://epe.si/download ==============================================================...

Telekom Bug Bounty #9 - Code Execution Vulnerability

Document Title: =============== Telekom Bug Bounty 9 - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1174 Dev Article:...

MobileCartly 1.0 - Arbitrary File Upload

Exploit Title: MobileCartly 1.0 Remote File Upload Vulnerability Google Dork: - Date: 14/08/2012 Exploit Author: ICheerNo0M Vendor Homepage: http://icheernoom.blogspot.com/ Software Link: http://mobilecartly.com/mobilecartly.zip Version: 1.0 Tested on: Ubuntu 10.10 + PHP 5.3.3 1. Vuln Code :...

Sql injection

SQL injection vulnerability in session.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to process.php. NOTE: some of these details are obtained from third party information...

CVE-2011-3776

phpFormGenerator 2.09 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by forms/process.php...

Information disclosure

phpFormGenerator 2.09 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by forms/process.php...

Unrestricted file upload

Unrestricted file upload vulnerability in process.php in Tizag Countdown Creator 3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via index.php, then accessing the uploaded file via a direct request to the file in pics/. NOTE: some of these...

CVE-2008-6492

CVE-2008-6492 describes an unrestricted file upload in process.php for the product “Tizag Countdown Creator 3.” An attacker can upload a file with an executable extension via index.php and then access the uploaded file in the pics/ directory to achieve remote code execution. Details note that som...

Easybe 1-2-3 Music Store Process.PHP SQL注入漏洞

Easybe 1-2-3 Music Store是一款基于PHP的WEB应用程序。 Easybe 1-2-3 Music Store不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击获得敏感信息。 问题是由于'Process.php'脚本对用户提交的'CategoryID'参数缺少过滤，提交恶意SQL查询作为参数数据，可导致应用程序处理时更改原来的SQL逻辑，攻击者可以获得敏感信息或者操作数据库。 Easybe 1-2-3 Music Store 1.0 目前没有解决方案提供： http://easybe.com/...

Sql injection

SQL injection vulnerability in process.php in Easybe 1-2-3 Music Store allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter...

CVE-2007-3520

SQL injection vulnerability in process.php in Easybe 1-2-3 Music Store allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter...

CVE-2007-3520

SQL injection vulnerability in process.php in Easybe 1-2-3 Music Store allows remote attackers to execute arbitrary SQL commands via the CategoryID parameter...

CVE-2007-3520

CVE-2007-3520 describes a SQL injection in the Easybe 1-2-3 Music Store, via the parameter CategoryID in process.php, allowing remote attackers to execute arbitrary SQL commands. The root cause is unsafely handling the CategoryID input, enabling injected SQL through the web interface. Documented ...

Easybe 1-2-3 Music Store - process.php SQL Injection

Easybe 1-2-3 Music Store - process.php SQL Injection --==+================================================================================+==-- --==+ Easybe 1-2-3 Music Store SQL Injection Vulnerability +==-- --==+================================================================================+==...