WordPress iFrame Admin Pages 0.1 Cross Site Scripting

Hi We have used our tool, THAPS, to identify vulnerabilities in this WordPress plugin. We have confirmed at least one of the reported vulnerabilities and created a working exploit located below. Attached is one or more log files containing the output of our tool, identifying the location of the...

CVE-2012-1672

The CVE-2012-1672 issue affects Hotel Booking Portal 0.1, specifically getcity.php where the country parameter is vulnerable to SQL injection. The vulnerability permits remote attackers to execute arbitrary SQL commands via the country POST parameter, with PoCs and public disclosures illustrating...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin/settings/update in DClassifieds 0.1 final allows remote attackers to hijack the authentication of administrators for requests that modify account settings such as the administrator password or email via certain Settings parameters...

CVE-2012-0990

The CVE-2012-0990 issue affects DClassifieds 0.1 final and is a Cross-site Request Forgery (CSRF) in admin/settings/update. The underlying flaw allows an attacker to hijack an administrator’s session to modify settings (e.g., administrator password or email) via crafted Settings[] parameters. Exp...

WordPress Filedownload Plugin 0.1 (download.php) Remote File Disclosure

Exploit for php platform in category web applications Exploit Title: WordPress Filedownload Plugin 0.1 download.php Remote File Disclosure Vulnerability Google Dork: inurl:"/wp-content/plugins/filedownload/download.php/?path" Date: 18-09-2011 Author: Septemb0x CYBER-WARRIOR Software Link:...

CVE-2009-5095

PHP remote file inclusion vulnerability in indexinc.php in ea gBook 0.1 and 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the incordner parameter...

Remote file inclusion

PHP remote file inclusion vulnerability in indexinc.php in ea gBook 0.1 and 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the incordner parameter...

CVE-2009-5095

CVE-2009-5095 concerns ea-gBook

cFTP 0.1 - 'r80' Arbitrary File Upload

Software Link: https://code.google.com/p/clients-oriented-ftp/downloads/list Version: 0.1 Tested on: linux // Vulnerable URL $url = 'http://url domain/cFTP/'; // The file to upload $filename = dirnameFILE.'/info.php'; $failext = array'php', 'pl'; $username = 'hackname'.rand0, 999999;...

cFTP 0.1 - r80 Arbitrary File Upload

cFTP 0.1 - r80 Arbitrary File Upload Software Link: https://code.google.com/p/clients-oriented-ftp/downloads/list Version: 0.1 Tested on: linux // Vulnerable URL $url = 'http://url domain/cFTP/'; // The file to upload $filename = dirnameFILE.'/info.php'; $failext = array'php', 'pl'; $username =...

OpenMyZip 0.1 - .zip Remote Buffer Overflow

OpenMyZip 0.1 - .zip Remote Buffer Overflow source: https://www.securityfocus.com/bid/47678/info OpenMyZip is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data. Attackers may leverage this issue to execute arbitrary code in the...

PHP Simple Gallery 0.1 Local File Include Vulnerability

Exploit for php platform in category web applications exploit title: local file include in PHP Simple Gallery 0.1 date: 18.o2.2o11 author: lemlajt software : PHP Simple Gallery vendor : http://sourceforge.net/projects/simple-gallery/ PoC:...

WordPress Plugin RSS Feed Reader 0.1 - 'rss_url' Cross-Site Scripting

source: https://www.securityfocus.com/bid/45997/info The RSS Feed Reader WordPress Plugin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

WORDPRESS Plugin Accept Signups 0.1 XSS

Exploit for php platform in category web applications Exploit Title: WORDPRESS Plugin Accept Signups PERSISTENT XSS Date:21/12/2010 Author: clshack Software Link:http://wordpress.org/extend/plugins/accept-signups/ Version:0.1 Tested on: wordpress 3.03 CVE : Vulnerable code accept-signupssubmit.ph...

WordPress Plugin Accept Signups 0.1 - Cross-Site Scripting

Exploit Title: WORDPRESS Plugin Accept Signups PERSISTENT XSS Date:21/12/2010 Author: clshack Software Link:http://wordpress.org/extend/plugins/accept-signups/ Version:0.1 Tested on: wordpress 3.03 CVE : Vulnerable code accept-signupssubmit.php: requireonce'../../../wp-config.php';//addslashes to...

[SECURITY] Fedora 13 Update: openttd-1.0.3-0.1.RC1.fc13

OpenTTD is modeled after a popular transportation business simulation game by Chris Sawyer and enhances the game experience dramatically. Many features were inspired by TTDPatch while others are original...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in Open Education System OES 0.1 beta allow remote attackers to execute arbitrary PHP code via a URL in the CONFINCLUDEPATH parameter to 1 forum/admin.php and 2 plotgraph/index.php in admin/modules/modules/, and 3 adminuser/modadmuser.php and 4...

29o3 CMS (LibDir) Multiple Remote File Inclusion Vulnerability

Description: Some vulnerabilities have been discovered in 2903 CMS, which can be exploited by malicious people to compromise a vulnerable system. Input passed to the "CONFIGLibDir" parameter in multiple files is not properly verified before being used to include files. This can be exploited to...

thEngine 0.1 Local File Inclusion

============================================================================================= ============================================================================================= == @@@@@@@@ @@@@@@ @@@@@@@ @@ @@ @@@@@@ @@ @@ @@@@@@@@ @@@@@@ == == @@@@@@@@ @@@@@@ @@@@@@@ @@@ @@@ @@@@@@ @@...

thEngine 0.1 - Local File Inclusion

thEngine 0.1 - Local File Inclusion ============================================================================================= ============================================================================================= == @@@@@@@@ @@@@@@ @@@@@@@ @@ @@ @@@@@@ @@ @@ @@@@@@@@ @@@@@@ == ==...