BP Profile Search <= 4.5.3 - PHP Object Injection

The plugin bp-profile-search insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector. This vulnerability was patched in version 4.6, information is being released now as a disclosure period has expired...

Yahoo Flaw Allowed Hackers to Read Anyone's Emails

Yahoo has patched a critical security vulnerability in its Mail service that could have allowed an attacker to spy on any Yahoo user's inbox. Jouko Pynnönen, a Finnish Security researcher from security firm Klikki Oy, reported a DOM based persistent XSS Cross-Site Scripting in Yahoo mail, which i...

Wordpress Plugin Single Personal Message 1.0.3 SQL injection vulnerability

Author:sebaoknow Chong Yu 404 security lab Date:2016-12-06 1. Vulnerability description Simple Personal Message is for WordPress website dedicated to create the privacy and security of information systems. Using Ajax operation, may be based on a group of users between the station within the...

Joomla Catalog 1.0.7 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Unauthenticated SQL Injection in Huge-IT Catalog v1.0.7 for Joomla Author: Larry W. Cashdollar, @larry0 Date: 2016-09-16 Download Site: http://huge-it.com/joomla-catalog/ Vendor: huge-it.com Vendor Notified: 2016-09-17 Vendor Contact:...

Wordpress Sirv plugin SQL injection vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A SQL injection vulnerability exists in the rowid parameter of the admin-ajax.php page of Wordpress plugin Sirv...

client.studygood.ru XSS vulnerability

Vulnerable URL: http://client.studygood.ru/login/ajax?jsoncallback=prompt/OPENBUGBOUNTY/...

app.tongbu.com XSS vulnerability

Vulnerable URL: http://app.tongbu.com/ajax/recommend?jsoncallback=prompt/OPENBUGBOUNTY/...

WordPress Plugin Product Catalog 8 1.2.0 - SQL Injection

Exploit Title: Product Catalog 8 1.2 Plugin WordPress – Sql Injection Date: 12/11/2016 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/product-catalog-8/ Software Link: https://wordpress.org/plugins/product-catalog-8/ Contact: http://twitter.com/lenonleite Website:...

vpbulgaria.com XSS vulnerability

Vulnerable URL: http://vpbulgaria.com/ajax/ajaxsearch.php?key=country=prompt/OPENBUGBOUNTY/...

voetbalkrant.com XSS vulnerability

Vulnerable URL: https://www.voetbalkrant.com/soccer/news/ajax-get-items.php?jsoncallback=prompt/OPENBUGBOUNTY/...

walfoot.be XSS vulnerability

Vulnerable URL: https://www.walfoot.be/soccer/news/ajax-get-items.php?jsoncallback=prompt/OPENBUGBOUNTY/...

key8.com XSS vulnerability

Vulnerable URL: http://www.key8.com/ajax/statussummary.php?z=1=prompt/OPENBUGBOUNTY/...

forum.arhn.eu XSS vulnerability

Vulnerable URL: http://forum.arhn.eu/ajax/ytapi.php?id=p-ZgdJplepA=prompt/OPENBUGBOUNTY/...

SQL Injection Vulnerability in ShowAjaxOptions Function of Tibco Call Center System

The core of the Tibco call center system is a communication-based enterprise internal and external communication system. A SQL injection vulnerability exists in the showAjaxOptions function of the Tibco Call Center System. Vulnerability file: /userweb/php/index/Outbound.class.php, exploit: UNION...

SQL Injection Vulnerability in Netqi CMS Web Management System 6.0

Netqi CMS website management system is a set of CMS system developed by Netqi, this system is developed using ASP.NET kernel. The system's ip/ajax.apsx page has an SQL injection vulnerability that allows arbitrary users to obtain database information...

SQL Injection Vulnerability in World Parameters under doyocms source/ajax.php File

DOYO universal station-building system using PHP and MYSQL development, is a free open source CMS station-building, enterprise station-building system , can be widely used for personal, business, government, institutions and many other website construction. doyocms system source/ajax.php file und...

SQL injection vulnerability in the molds parameter under the source/ajax.php file of doyocms system

DOYO universal station-building system using PHP and MYSQL development, is a free open source CMS station-building, enterprise station-building system , can be widely used for personal, business, government, institutions and many other website construction. doyocms system source/ajax.php file und...

FreePBX Recordings Backdoor Upload

Added: 10/14/2016 Background FreePBX is a web-based open-source graphical user interface used to manage Asterisk PBX, an open-source communication server. The FreePBX System Recordings module allows playback of recorded files. Problem The System Recordings module in FreePBX 13 and 14 is vulnerabl...

FreePBX Recordings Backdoor Upload

Added: 10/14/2016 Background FreePBX is a web-based open-source graphical user interface used to manage Asterisk PBX, an open-source communication server. The FreePBX System Recordings module allows playback of recorded files. Problem The System Recordings module in FreePBX 13 and 14 is vulnerabl...

FreePBX Recordings Backdoor Upload

Added: 10/14/2016 Background FreePBX is a web-based open-source graphical user interface used to manage Asterisk PBX, an open-source communication server. The FreePBX System Recordings module allows playback of recorded files. Problem The System Recordings module in FreePBX 13 and 14 is vulnerabl...