blogsystem 1.4 >> local & remote = -rfi & lfi & -xss

demo: blog23.com by : hackerz.ir userz ! ADMIN/index.php include$category."/".$folder."".$page.".php"; ADMIN/index.php include$category."/".$action.".php"; ADMIN/login.php include$lngTexts; ADMIN/login.php include$lngConfig; BO/index.php include$category."/".$folder."".$page.".php"; BO/index.php...

CVE-2007-2000

Multiple SQL injection vulnerabilities in admin/admin.php in Crea-Book 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 pseudo or 2 passe parameter...

CVE-2007-2000

Multiple SQL injection vulnerabilities in admin/admin.php in Crea-Book 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 pseudo or 2 passe parameter...

wls-xss.txt

Windows Live Spaces has a XSS vulnerability in NetworkSetup.aspx page. This vuln affects every windows live space and it works only on logged users. With this vuln you can grab cookies and so gain the access to the blog's admin panel, where you can edit user's options and data, MSN Messenger...

vbulletin admincp sql injection

// CREDIT: discovered by meto5757 and disfigure PRODUCT: vBulletin http://www.vbulletin.com/ VULNERABILITY: SQL Injection NOTES: - not a serious vulnerability, can only be used by administrator of site - SQL injection can be used to obtain password hash - tested on 3.6.4 and 3.6.5 POC: 1. Log in ...

BP Blog 7.0 (default.asp layout) Remote SQL Injection Vulnerability

No description provided by source. BeyazKurt Script : BP Blog D0rk : "Powered by BP Blog 7.0" thnx : Forever.slam and all WorldHackerz Team! WorldHackerz Mirr0r'da Taht Bizimdir h := ------- Exploit :...

[Full-disclosure] vbulletin admincp sql injection

// CREDIT: discovered by meto5757 and disfigure PRODUCT: vBulletin http://www.vbulletin.com/ VULNERABILITY: SQL Injection NOTES: - not a serious vulnerability, can only be used by administrator of site - SQL injection can be used to obtain password hash - tested on 3.6.4 and 3.6.5 POC: 1. Log in ...

HC Newssystem 1.0-1.4 (index.php ID) Remote SQL Injection Vulnerability

No description provided by source. HC NEWSSYSTEM 1.0-4 index.php "ID" Blind SQL Injection Type : SQL Injection Release Date : 2007-03-08 Product / Vendor : HC Design News Publisher. http://www.hcdesign.at/demo Bug : http://localhost/script/index.php?option=news&aktion=komm&ID=-SQL Inj.- SQL Inj...

BP Blog 7.0 - layout SQL Injection

BP Blog 7.0 - layout SQL Injection BeyazKurt Script : BP Blog D0rk : "Powered by BP Blog 7.0" thnx : Forever.slam and all WorldHackerz Team! WorldHackerz Mirr0r'da Taht Bizimdir h := ------- Exploit :...

BP Blog 7.0 - 'layout' SQL Injection

BeyazKurt Script : BP Blog D0rk : "Powered by BP Blog 7.0" thnx : Forever.slam and all WorldHackerz Team! WorldHackerz Mirr0r'da Taht Bizimdir h := ------- Exploit :...

HC Newssystem 1.0-1.4 - index.php?ID SQL Injection

HC Newssystem 1.0-1.4 - index.php?ID SQL Injection HC NEWSSYSTEM 1.0-4 index.php "ID" Blind SQL Injection Type : SQL Injection Release Date : 2007-03-08 Product / Vendor : HC Design News Publisher. http://www.hcdesign.at/demo Bug : http://localhost/script/index.php?option=news&aktion=komm&ID=-SQL...

HC NEWSSYSTEM 1.0-4 (index.php "ID") Blind SQL Injection

HC NEWSSYSTEM 1.0-4 index.php "ID" Blind SQL Injection Type : SQL Injection Release Date : 2007-03-08 Product / Vendor : HC Design News Publisher. http://www.hcdesign.at/demo Bug : http://localhost/script/index.php?option=news&aktion=komm&ID=-SQL Inj.- SQL Inj Code : Admin Username/Password Query...

HC Newssystem 1.0-1.4 - 'index.php?ID' SQL Injection

HC NEWSSYSTEM 1.0-4 index.php "ID" Blind SQL Injection Type : SQL Injection Release Date : 2007-03-08 Product / Vendor : HC Design News Publisher. http://www.hcdesign.at/demo Bug : http://localhost/script/index.php?option=news&aktion=komm&ID=-SQL Inj.- SQL Inj Code : Admin Username/Password Query...

HC Newssystem 1.0-1.4 (index.php ID) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ======================================================================= HC Newssystem 1.0-1.4 index.php ID Remote SQL Injection Vulnerability ======================================================================= HC NEWSSYSTEM 1.0-4...

DEBIAN-CVE-2007-1244

Cross-site request forgery CSRF vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting X...

WordPress Admin Panel Plugin <= 2.1.1 - CSRF

Because of this vulnerability, the attackers can perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. Solution Update the WordPress Admin Panel plugin to the latest version at least 2.1.2...

CVE-2007-0592

Cross-site scripting XSS vulnerability in EzDatabase 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to admin/login.php and the Admin Panel Database...

Cross site scripting

Cross-site scripting XSS vulnerability in EzDatabase 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to admin/login.php and the Admin Panel Database...

CVE-2007-0592

Cross-site scripting XSS vulnerability in EzDatabase 2.1.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to admin/login.php and the Admin Panel Database...

CVE-2007-0592

CVE-2007-0592 is an XSS vulnerability in EzDatabase 2.1.3. The affected component is EzDatabase’s admin/login.php and the Admin Panel Database, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD entry indicates a CVSSv2 base score of 6.8 (Medium) wit...