DEBIAN-CVE-2015-7984

Multiple cross-site request forgery CSRF vulnerabilities in Horde before 5.2.8, Horde Groupware before 5.2.11, and Horde Groupware Webmail Edition before 5.2.11 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary 1 commands via the cmd paramet...

Seditio CMS 1.7.1 Password Disclosure

Exploit Title: Seditio CMS Multiple Vulnerabilities + Google Dork: intext:"Powered by Seditio CMS" + Date: 27/7/2015 + Exploit Author: Arash Khazaei + Vendor Homepage: http://www.seditiocms.com/ + Software Link: http://www.seditiocms.com/page.php?id=20&a=dl + Version: 1.7.1Last Version + Tested...

WordPress ClickBank Ads 1.7 CSRF / Cross Site Scripting

================================================================ CSRF/Stored XSS Vulnerability in ClickBank Ads V 1.7 Plugin ================================================================ . contents:: Table Of Content Overview ======== Title :CSRF and Stored XSS Vulnerability in ClickBank Ads...

Magento Web E-Commerce Platform Multiple Vulnerabilities

Magento Web E-Commerce Platform is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-2083

Cross-site request forgery CSRF vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php...

DFLabs PTK Cross-Site Request Forgery Vulnerability

DFLabs PTK is a powerful collection of digital investigative, forensic tools. A cross-site request forgery vulnerability exists in versions of DFLabs PTK prior to 1.0.5, which allows remote attackers to hijack an administrator's or researcher's authentication to trigger a logout request...

WordPress Plugin TwitterDash Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. A cross-site request forgery vulnerability exists in the WordPress plugin TwitterDash, which allows remote attackers to hijack the...

Drupal 7.0 7.31 - Drupalgeddon SQL Injection (Admin Session)

Drupal 7.0 7.31 - Drupalgeddon SQL Injection Admin Session //· include 'common.inc'; include 'password.inc'; // set values $username = 'admin'; $url = isset$argv1?$argv1:''; $userid = isset$argv2?intval$argv2:1; if $url == '-h' echo "usage:\n"; echo $argv0.' $url $userid'."\n"; die; if empty$url ...

Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Admin Session)

//· include 'common.inc'; include 'password.inc'; // set values $username = 'admin'; $url = isset$argv1?$argv1:''; $userid = isset$argv2?intval$argv2:1; if $url == '-h' echo "usage:\n"; echo $argv0.' $url $userid'."\n"; die; if empty$url || strpos$url,'https' === False echo "please state the cook...

AlstraSoft E-Friends <= 4.21 Admin Session Retrieve Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo AlstraSoft E-Friends = 4.21 Admin Session Retrieve Exploit by BlackHawk [email protected] http://itablackhawk.altervista.org Thanks to rgod for the php code and Marty for the Love ; if $argc2 echo Usage: php .$argv0...

Horde 3.3.5 - "PHP_SELF" XSS vulnerability

No description provided by source. ============================================= INTERNET SECURITY AUDITORS ALERT 2009-012 - Original release date: October 13th, 2009 - Last revised: December 16th, 2009 - Discovered by: Juan Galiana Lara - CVE ID: CVE-2009-3701 - Severity: 6.3/10 CVSS Base Score...

PhpWebGallery <= 1.7.2 Session Hijacking / Code Execution Exploit

No description provided by source. ?php / ------------------------------------------------------------------------ PhpWebGallery = 1.7.2 Remote Session Hijacking / Code Execution Exploit ------------------------------------------------------------------------ author...: EgiX mail.....:...

Advanced Poll <= 2.0.5-dev Remote Admin Session Generator Exploit

No description provided by source. !/usr/bin/perl -w Advanced Poll 2.0.0 = 2.0.5-dev textfile admin session gen. 0day! KEEP IT PRIVATE 0day! date: 30/07/06 diwou [email protected] PHCKSEC c 2001-2006. see templates for code execution ;. use strict; use warnings; use LWP::UserAgent; use MD5; my...

SePortal SQLi - Remote Code Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...

F3Site <= 2.1 - Remote Code Execution Exploit

No description provided by source. ? // //Kacper & str0ke Settings $exploitname = F3Site = 2.1 Remote Code Execution Exploit; $scriptname = F3Site 2.1; $scriptsite = http://dhost.info/compmaster/; $dork = 'Powered by F3Site'; //to work exploit you need admin session, and cookies prefix // print '...

XT:Commerce < 3.04 SP2.1 XSS Vulnerability

No description provided by source. ---------------------------------------------------------------------------------- Cross-Site-Scripting XT:Commerce 3.04 SP2.1 ---------------------------------------------------------------------------------- Affected Software .: XT:Commerce 3.04 SP2.1 Venedor...

phpBP <= RC3 (2.204) (sql/cmd) Remote Code Execution Exploit

No description provided by source. ? // //Kacper & str0ke Settings $exploitname = phpBP = RC3 2.204 sql/cmd Remote Code Execution Exploit; $scriptname = phpBP RC3 2.204; $scriptsite = http://www.phpbp.com/; $dork = 'Silnik strony jest chroniony prawami autorskimi PHP BP Team'; //to work exploit y...

AlienVault OSSIM SQL注入以及远程代码执行

这个模块利用一个未授权SQL注入漏洞，影响AlienVault OSSIM 4.3.1以下版本。这个SQL注入漏洞可以用来找回一个活动的admin session ID，如果一个管理员级别的用户被认证了，payload中一个action可以创建一个高授权策略来执行任意代码。 0 4.3.1以及更低的版本 更新为最新的AlienVault OSSIM This module requires Metasploit: http//metasploit.com/download Current source:...

AlienVault OSSIM SQL Injection / Code Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "AlienVault OSSIM SQL Injection and Remote Code Execution", 'Description' = %q This module exploits an unauthenticated SQL injection...

Alienvault Open Source SIEM (OSSIM) - SQL Injection / Remote Code Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "AlienVault OSSIM SQL Injection and Remote Code Execution", 'Description' = %q This module exploits an unauthenticated SQL injection...