Magento Community Edition < 1.9.2.3 Multiple Vulnerabilities

Binary data 9679.prm...

RSS News AutoPilot Script 1.0.1 / 3.1.0 - Admin Panel Authentication Bypass

Exploit for php platform in category web applications Exploit Title: RSS News AutoPilot Script - Admin Panel Authentication Bypass Date: 14 October 2016 Exploit Author: Arbin Godar Website : ArbinGodar.com Software Link: https://codecanyon.net/item/rss-news-autopilot-script/11812898 Version: 1.0....

RSS News AutoPilot Script 1.0.13.1.0 - Admin Panel Authentication Bypass

RSS News AutoPilot Script 1.0.13.1.0 - Admin Panel Authentication Bypass Exploit Title: RSS News AutoPilot Script - Admin Panel Authentication Bypass Date: 14 October 2016 Exploit Author: Arbin Godar Website : ArbinGodar.com Software Link:...

RSS News AutoPilot Script 1.0.1/3.1.0 - Admin Panel Authentication Bypass

Exploit Title: RSS News AutoPilot Script - Admin Panel Authentication Bypass Date: 14 October 2016 Exploit Author: Arbin Godar Website : ArbinGodar.com Software Link: https://codecanyon.net/item/rss-news-autopilot-script/11812898 Version: 1.0.1 to 3.1.0...

Simple Blog PHP 2.0 SQL Injection

===================================================== Simple Blog PHP 2.0 - SQL Injection ===================================================== Vendor Homepage: http://simpleblogphp.com/ Date: 13 Oct 2016 Demo Link : http://simpleblogphp.com/blog/admin.php Version : 2.0 Platform : WebApp - PHP...

Brave Software: Brave: Admin Panel Access

Steps to reproduce While browsing through the https://blog.brave.com/admin, it is getting redirected to a admin login panel https://brave.ghost.io/ghost/signin/. Consequence An attacker can easily enumerate this admin panel with the url such as https://blog.brave.com/admin and with brute force...

Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin)

Simple PHP Blog 0.8.4 - Cross-Site Request Forgery Add Admin that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- input t...

Simple PHP Blog 0.8.4 Cross Site Request Forgery

that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- inp...

Car CMS v3.00.30 - Search Cross Site Scripting Vulnerability

Product & Service Introduction: =============================== Car Portal is a php software product for running auto classifieds websites. It provides functionality for the private sellers to sign up, list their car for sale and make changes in their ads online using the private sellers...

KV Site Admin CMS 3.0 SQL injection Vulnerability

Exploit for php platform in category web applications Exploit Title : KV Site Admin CMS 3.0 SQL injection Vulnerability Exploit Author : xBADGIRL21 Dork : e.World Technology Ltd. All rights reserved "Admin Area - Version 3.0" Version: 3.0 MyBlog: http://xbadgirl21.blogspot.com Tested on: BackBox...

WordPress InfiniteWP Admin Panel Authentication Bypass Vulnerability

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An authentication bypass vulnerability exists in the WordPress InfiniteWP Admin Panel. Because app/php does n...

WordPress InfiniteWP Admin Panel 2.8.0 Command Injection

------------------------------------------------------------------------ Command injection in InfiniteWP Admin Panel ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstract...

WordPress InfiniteWP Admin Panel 2.8.0 Authorization Bypass

------------------------------------------------------------------------ Authorization bypass in InfiniteWP Admin Panel ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstra...

BSNL Teracom Router Firmware Rewrite / Link Modification

Multiple Vulnerabilities in TERACOM ROUTER Author: Ajay Gowtham aka AJOXR Contact: gowtham.ajay5 at gmail.com Vulnerability Type: Insecure Upload File Permissions Affected Module: Upload Functionality Criticality: Medium Device Model: BSNL Teracom T2-B-Gawv1.4U10Y-BI is WiFi enabled ADSL2+...

KV Site Admin CMS 3.0 SQL Injection

Exploit Title : KV Site Admin CMS 3.0 SQL injection Vulnerability Exploit Author : xBADGIRL21 Dork : e.World Technology Ltd. All rights reserved "Admin Area - Version 3.0" Version: 3.0 MyBlog: http://xbadgirl21.blogspot.com Tested on: BackBox skype:xbadgirl21 Video Proof :...

FreePBX 13.0.35 Remote Code Execution

Vulnerable software : Freepbx Tested version : 13.0.35 vendor : freepbx.org Author : Ahmed sultan 0x4148 Email : [email protected] Summary : FreePBX is a web-based open source GUI graphical user interface that controls and manages Asterisk PBX, an open source communication server, With over 1...

GitLab: Ability to access all user authentication tokens, leads to RCE

Vulnerability details The project export feature serializes the user objects of team members and stores it in the project.json file. This object contains the authenticationtoken for every user, meaning that an attacker can simply go ahead and create a project on GitLab.com, add one of the admins ...

Xfinity Gateway (Technicolor DPC3941T) - Cross-Site Request Forgery

Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Date: 09/08/2016 Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The Device DPC3941T is vulnerable to CSRF and has no security on the entire admin panel for it...

Xfinity Gateway (Technicolor DPC3941T) - Cross-Site Request Forgery

Xfinity Gateway Technicolor DPC3941T - Cross-Site Request Forgery Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Date: 09/08/2016 Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The Device DPC3941T is...

InfiniteWP Admin Panel 2.8.0 - authorization bypass

InfiniteWP Admin Panel version 2.8.0 has vulnerable authentication method. Solution Update InfiniteWP Admin Panel plugin at least to 2.9.0 version...