Online Airline Booking System Authentication Bypass

Exploit Title : Online Airline Booking System multiple vulnerabilities Author : WICS Date : 05/1/2016 Software Link : http://sourceforge.net/projects/oabs/ Affected Version: All Overview: The Online Airline Booking System is designed to be an all in one solution for an airline wishing to speed up...

CVE-2011-5315

Cross-site request forgery CSRF vulnerability in admin/index.php in whCMS 0.115 alpha allows remote attackers to hijack the authentication of administrators for requests that modify credentials via a user save action...

Lazarus Guestbook 1.22 XSS / SQL Injection

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: Lazarus Guestbook 1.22 Multiple Persistent Cross-Site Scripting - Sql Injection Vulnerability Date: 23/12/2014 Url Vendor:...

WordPress Simple Visitor Stat Cross Site Scripting

Title: WordPress 'Simple Visitor Stat' plugin - Stored XSS Reported by: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2014/12/12 Download: https://wordpress.org/plugins/simple-visitor-stat/ ---------------------------------------------------------------- Description:...

CVE-2014-8488

Cross-site scripting XSS vulnerability in the administrator panel in Yourls 1.7 allows remote attackers to inject arbitrary web script or HTML via a URL that is processed by the Shorten functionality...

CVE-2014-8488

The CVE-2014-8488 entry is corroborated by connected advisories showing Fedora updates for yourls 1.7 (e.g., FEDORA-2015-5965/5972) addressing an XSS in the administrator panel via the Shorten functionality. Affected product: YOURLS (PHP-based URL shortening) software package 1.7; vulnerability t...

InfiniteWP SQL Injection / File Upload / Insecure Password Storage

Multiple vulnerabilities in InfiniteWP Admin Panel https://lifeforms.nl/20141210/infinitewp-vulnerabilities/ ----- InfiniteWP http://www.infinitewp.com/ allows an administrator to manage multiple Wordpress sites from one control panel. According to the InfiniteWP homepage, it is used on over...

RobotStats 1.0 - robot SQL Injection

RobotStats 1.0 - robot SQL Injection Title : RobotStats v1.0 robot param SQL Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo :...

RobotStats 1.0 - HTML Injection

RobotStats 1.0 - HTML Injection Title : RobotStats v1.0 HTML Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstat...

WordPress 4.0.1 Cross-Site Scripting Vulnerability Patch

WordPress’s latest update, 4.0.1, patches a critical cross-site scripting vulnerability affecting comment boxes on websites running the content management system software. An attacker would need only to inject malicious JavaScript into a comment that would infect a reader viewing it on the webpag...

Maarch LetterBox 2.8 Insecure Cookie Handling

Title : Maarch LetterBox 2.8 Insecure Cookie Handling Vulnerability Login Bypass Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Date : 17.11.2014 Demo : http://www.era.sn/courrier Download :...

D-Link DAP-1360 Abuse / Cross Site Request Forgery

D-Link DAP-1360 suffers from cross site request forgery, abuse of functionality, and brute force vulnerabilities. There are Abuse of Functionality, Brute Force and Cross-Site Request Forgery vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected...

SEC Consult SA-20141029-0 :: Multiple critical vulnerabilities in Vizensoft Admin Panel

SEC Consult Vulnerability Lab Security Advisory 20141029-0 ======================================================================= title: Multiple critical vulnerabilities product: Vizensoft Admin Panel vulnerable version: 2014 fixed version: - impact: critical homepage: http://www.vizensoft.com...

Yourls 1.7 Cross Site Scripting

Hello, I found a xss stored vulnerability in Yourls 1.7 script latest version. The attacker can steal the admin's cookies and login in the admin panel. Note: Only the admin can see this. Steps to perform the vulnerability: 1. Create a new url to shorten -- In the inputs you need write this payloa...

NDBLOG 0.1 Cross Site Scripting / SQL Injection

NDBLOG version 0.1 multi Vulnerability ====================================== Author : indoushka Vondor : ALAMARAB2.com Dork : جميع الحقوق محفوظة © - ALAMARAB2.com - NDBLOG v0.1 ================================================== Sql injection : http://localhost/ND/blog.php?id=85 inject her Blind...

Phpok漏洞礼包组合可shell

简要描述： Phpok漏洞礼包，组合可shell 详细说明： 1.2处存储行xss 2.添加管理员帐号密码+利用点 3.后台写shell 1. 第一处 我们先来注册一个帐号。 其中帐号这内容为 a';document.write''// 注册好之后。 后台 需要点击才能激活xss 第二处 留言 留言主题...

Yahoo Quickly Fixes SQL Injection Vulnerability Escalated to Remote Code Execution

Yahoo! was recently impacted by a critical web application vulnerabilities which left website's database and server vulnerable to hackers. A cyber security expert and penetration tester, Ebrahim Hegazy a.k.a Zigoo from Egypt, has found a serious SQL injection vulnerability in Yahoo's website that...

Zen Cart 1.5.3 - Multiple Vulnerabilities

No description provided by source. Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id...

(Plone): Restricted Python injection

It was discovered that Plone, included as a part of luci, did not properly protect the administrator interface control panel. A remote attacker could use this flaw to inject a specially crafted Python statement or script into Plone's restricted Python sandbox that, when the administrator interfac...

TNG Sitebuilding v. 10.0.3 - Admin Panel Motion Logs Downloader Exploit

Admin adminlog.txt all his movements are recorded file. This log file is displayed in the target's local directory Database backup taken in this file where records are shown to be and you can easily download a database backup Usage Info perl www.target.com /path/ TNG Sitebuilding v. 10.0.3 - Admi...