WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection

WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection + Calculated Fields Form Wordpress Plugin = 1.0.10 - Remote SQL Injection Vulnerability + Author: Ibrahim Raafat + Twitter: https://twitter.com/RaafatSEC + Plugin: https://wordpress.org/plugins/calculated-fields-form/ + TimeLine - Feb...

WordPress Plugin Calculated Fields Form 1.0.10 - SQL Injection

Calculated Fields Form Wordpress Plugin = 1.0.10 - Remote SQL Injection Vulnerability + Author: Ibrahim Raafat + Twitter: https://twitter.com/RaafatSEC + Plugin: https://wordpress.org/plugins/calculated-fields-form/ + TimeLine - Feb 6 2015, The vulnerabilities reported - Feb 7 2015, Response and...

WordPress Calculated Fields Form 1.0.10 SQL Injection

Calculated Fields Form Wordpress Plugin = 1.0.10 - Remote SQL Injection Vulnerability + Author: Ibrahim Raafat + Twitter: https://twitter.com/RaafatSEC + Plugin: https://wordpress.org/plugins/calculated-fields-form/ + TimeLine - Feb 6 2015, The vulnerabilities reported - Feb 7 2015, Response and...

HDWIKI最新版Update注入可修改管理员密码（MYSQL进制技巧）

简要描述： 最新版HDWIKI 5.1 GBK 无视GPC 上首页吧！ 详细说明： 问题出在\hdwiki\control\user.php下 最新版HDWIKI 5.1 GBK版本 HDWIKI全局过滤，但是面对宽字节注入，就容易出问题了 function doeditprofile ifisset$this-post'submit' $gender = intval$this-post'gender'; $birthday = strtotime$this-post'birthday'; $location = $this-post'location'; $signature =...

EasyCart <= 3.0.15 - Unrestricted File Upload

In versions = 3.0.8 this can be exploited by authenticating as any WordPress user, and in versions 3.0.9 - 3.0.15 can be exploited by passing a valid password hash being used by any admin in the EasyCart user system...

WordPress WP EasyCart Unrestricted File Upload Exploit

WordPress Shopping Cart WP EasyCart Plugin for WordPress contains a flaw that allows a remote attacker to execute arbitrary PHP code. This flaw exists because the /inc/amfphp/administration/banneruploaderscript.php script does not properly verify or sanitize user-uploaded files. By uploading a .p...

CVE-2015-0930

The web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a100 has a hardcoded administrative password, which makes it easier for remote attackers to obtain access via an HTTP session...

MantisBT Cross-Site Scripting Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the admin/install.php script in MantisBT versions 1.2.18 and earlier...

Beeswarm - Active IDS made easy

Beeswarm is an active IDS project that provides easy configuration, deployment and management of honeypots and clients. The system operates by luring the hacker into the honeypots by setting up a deception infrastructure where deployed drones communicate with honeypots and intentionally leak...

TurboMail 前台sql注入漏洞

简要描述： 前台注入存在注入，可查看管理员密码甚至getshell。 详细说明： 0x1 前台注入 turbomail\web\webapps\ROOT\enterprise\noteadd.jsp: ... UserInfo userinfo = ms.userinfo; if userinfo == null XInfo.gotoInfoms,request,response,"info.loginfail",null,0; return; String id = request.getParameter"id";//id参数传入，没有过滤 Note note = null;...

SweetRice CMS Password Reset Vulnerability

SweetRice is a simple content management system developed using PHP. A password reset vulnerability in as/index.php in SweetRice CMS versions prior to 0.6.7.1 allows remote attackers to modify the administrator's password by specifying the administrator's email address in the email parameter...

CVE-2010-5318

CVE-2010-5318 affects SweetRice CMS prior to version 0.6.7.1. The vulnerability resides in the password-reset feature of as/index.php, where remote attackers can modify the administrator password by supplying the administrator’s email address in the email parameter. No exploit details are provide...

Osclass 3.4.2 SQL Injection Vulnerability

Osclass versions 3.4.2 and below suffer from a remote SQL injection vulnerability. ------------------------------------------------------------------- Osclass = 3.4.2 Search::setJsonAlert SQL Injection Vulnerability ------------------------------------------------------------------- - Software...

ZTE ZXDSL Modem Information Disclosure Vulnerability (Nov 2014) - Active Check

ZTE ZXDSL modem devices are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ZTE ZXDSL 831CII - Insecure Direct Object Reference

Exploit Title: ZTE ZXDSL 831 Insecure Direct Object Reference Date: 11/3/2014 Exploit Author: Paulos Yibelo Vendor Homepage: zte.com.cn Software Link: - Version: - Tested on: Windows 7 CVE :- ZTE ZXDSL 831CII suffers from an insecure direct object reference vulnerability that allows for...

Visual Mining NetCharts Server Remote Code Execution Exploit

This Metasploit module exploits multiple vulnerabilities in Visual Mining NetCharts. First, a lack of input validation in the administration console permits arbitrary jsp code upload to locations accessible later through the web service. Authentication is typically required, however a 'hidden' us...

Visual Mining NetCharts Server Remote Code Execution

This module exploits multiple vulnerabilities in Visual Mining NetCharts. First, a lack of input validation in the administration console permits arbitrary jsp code upload to locations accessible later through the web service. Authentication is typically required, however a 'hidden' user is...

CVE-2014-7158

Cross-site request forgery CSRF vulnerability in Exinda WAN Optimization Suite 7.0.0 2160 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to admin/launch...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Exinda WAN Optimization Suite 7.0.0 2160 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to admin/launch...

CVE-2014-7158

Cross-site request forgery CSRF vulnerability in Exinda WAN Optimization Suite 7.0.0 2160 allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to admin/launch...