QYKCMS update.php page has an arbitrary file deletion vulnerability

QYKCMS is a lightweight intelligent website building system based on PHP+MySql developed by QYK. QYKCMS update.php page exists arbitrary file deletion vulnerability. Allow attackers to exploit the vulnerability to delete arbitrary files, such as deleting install.lck for CMS reloading, hijacking t...

Steam Profile Integration 2.0.11 - SQL injection

Steam Profile Integration 2.0.11 - SQL injection Exploit Title: IPS Community Suite - Steam Profile Integration 2.0.11 and below SQL injection Google Dork: inurl:tab=nodesteamsteamprofile Date: 13/03/2017 Exploit Author: DrWhat Vendor Homepage:...

akasa.cn XSS vulnerability

Vulnerable URL: http://akasa.cn/update.php?no=181=AK-HPC01-BK="=product/product.detail.tplsub=2.5 Enclosure Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 14:48 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

akasa.biz XSS vulnerability

Vulnerable URL: http://www.akasa.biz/update.php?no=181="=Notebook coolers=product/product.detail.tplsub=NB Coolers Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

osCommerce <= 2.2 (extras) Source Code Disclosure Vulnerability

No description provided by source. ---- osCommerce = 2.2 extras/ information/source code disclosure ------------ software site: http://www.oscommerce.com/ if extras/ folder is placed inside the www path, you can see all files on target system, including php source code with database details, poc:...

Logaholic update.php page Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/27003/info Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fail...

Secworld waf /admin/ids/waf_update.php 命令执行漏洞

No description provided by source...

CVE-2012-5231

miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted 1 pagename or 2 area variable containing an executable extension, which is not properly handled by a update.php when writing files to content/, or b updatenews.php when writing files to content/news/...

Code injection

miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted 1 pagename or 2 area variable containing an executable extension, which is not properly handled by a update.php when writing files to content/, or b updatenews.php when writing files to content/news/...

CVE-2012-4393

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use 1 addBookmark.php, 2 delBookmark.php, or 3 editBookmark.php in bookmarks/ajax/; 4 calendar/delete.php, 5 calendar/edit.php...

MiniCMS 1.02.0 - PHP Code Injection

MiniCMS 1.02.0 - PHP Code Injection Title : miniCMS v1.0 : v2.0 php inject code Author : Or4nG.M4n Version : all version GDork : "This site is managed using MiniCMS©" Download : http://sourceforge.net/projects/mini-cms/files/mini-cms/ Thnks : +----------------------------------+ | xSs m4n i-Hmx...

CVE-2008-7186

Coppermine Photo Gallery CPG 1.4.14 does not restrict access to update.php, which allows remote attackers to obtain sensitive information such as the database table prefix via a direct request. NOTE: this might be leveraged for attacks against CVE-2008-0504...

Design/Logic Flaw

Coppermine Photo Gallery CPG 1.4.14 does not restrict access to update.php, which allows remote attackers to obtain sensitive information such as the database table prefix via a direct request. NOTE: this might be leveraged for attacks against CVE-2008-0504...

CVE-2008-7186

Coppermine Photo Gallery CPG 1.4.14 does not restrict access to update.php, which allows remote attackers to obtain sensitive information such as the database table prefix via a direct request. NOTE: this might be leveraged for attacks against CVE-2008-0504...

RSMScript 1.21 XSS/Insecure Cookie Handling Vulnerabilities

Exploit for unknown platform in category web applications =========================================================== RSMScript 1.21 XSS/Insecure Cookie Handling Vulnerabilities =========================================================== START 0x01 Informations: Script : RSMScript 1.21 Download :...

RSMScript 1.21 XSS/Insecure Cookie Handling Vulnerabilities

No description provided by source. START 0x01 Informations: Script : RSMScript 1.21 Download : http://www.hotscripts.com/jump.php?listingid=78547&jumptype=1 Vulnerability : Insecure Cookie Handling / XXS Author : Osirys Contact : osirysatlivedotit Website : http://osirys.org Notes : Proud to be...

RSMScript 1.21 - Cross-Site Scripting / Insecure Cookie Handling

START 0x01 Informations: Script : RSMScript 1.21 Download : http://www.hotscripts.com/jump.php?listingid=78547&jumptype=1 Vulnerability : Insecure Cookie Handling / XXS Author : Osirys Contact : osirysatlivedotit Website : http://osirys.org Notes : Proud to be Italian Greets: : XaDoS, x0r, emgent...

CVE-2008-4781

Directory traversal vulnerability in update.php in MyKtools 2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the langage parameter...

Directory traversal

Directory traversal vulnerability in update.php in MyKtools 2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the langage parameter...

CVE-2008-4781

A CVE-2008-4781 entry concerns a directory traversal in update.php of MyKtools 2.4. The vulnerability allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langage parameter, enabling local file inclusion and potential code execution. The affected componen...