Directory traversal

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

CVE-2014-9311

CVE-2014-9311 affects the WordPress Shareaholic plugin prior to version 7.6.1.0. The vulnerability is a cross-site scripting (XSS) flaw in admin.php where authenticated users can inject arbitrary script/HTML via the location[id] parameter in the shareaholic_add_location action to wp-admin/admin-a...

WordPress Plugin MiwoFTP 1.0.5 - Multiple Cross-Site Request Forgery Cross-Site Scripting Vulnerabilities

WordPress Plugin MiwoFTP 1.0.5 - Multiple Cross-Site Request Forgery Cross-Site Scripting Vulnerabilities WordPress MiwoFTP Plugin 1.0.5 Multiple CSRF XSS Vulnerabilities Vendor: Miwisoft LLC Product web page: http://www.miwisoft.com Affected version: 1.0.5 Summary: MiwoFTP is a smart, fast and...

CVE-2015-0950

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

CVE-2015-0950

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

WordPress Simple Ads Manager 2.5.94 / 2.5.96 SQL Injection

Vulnerability title: Wordpress plugin Simple Ads Manager - Multiple SQL Injection Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Download link: https://wordpress.org/plugins/simple-ads-manager/ CV...

Wordpress Simple Ads Manager Plugin - Multiple SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability title: Wordpress plugin Simple Ads Manager - SQL Injection Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Download link:...

精讯CMS SQL注入（通杀）

简要描述： 底层模型解析出错，导致大面积注入。 这是真的注入，真的能注出数据的。 无视新版添加的webscan.class.php 详细说明： 找注入，上来就看sql语句是怎么处理的。 jxcms的model调用数据库操作无论是 -where -find 都会调用/jxcms/lib/core/db.class.php文件中的checkOneWhere函数进行组装与过滤。 private function checkOneWhere$str $tmp = pregreplace'/"|'.?\1/s', '', $str; $tmp = strtoupper$tmp; if...

WordPress Plugin Google Analytics by Yoast 'class-admin.php' HTML Injection Vulnerability

WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. An HTML injection vulnerability exists in the WordPress plugin Google Analytics by Yoast 'class-admin.php'. An attacker can exploit the vulnerability to execute...

Smart PHP Poll - Authentication Bypass

Exploit Title: Smart PHP Poll Auth Bypass Vulnerability Google Dork: Copyright � Smart PHP Poll. All Rights Reserved. Exploit Author: Mr.tro0oqy from Yemen Email : [email protected] Download Script :http://www.scriptsez.net/download/download.php?action=download&p=smartphppoll.zip&ns=1 go to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the imagefile parameter in an edit action in the...

CVE-2015-2083

CVE-2015-2083 describes a Cross-site Request Forgery (CSRF) in Ilch CMS. An attacker can exploit requests to admin.php with a profilefields action to add a value to a profile field, potentially hijacking an administrator’s session/authentication. The vulnerability is documented across multiple so...

Piwigo 'admin.php' Cross-Site Scripting Vulnerability

Piwigo is a photo album script written in PHP. A cross-site scripting vulnerability exists in versions of Piwigo prior to 2.7.4, which allows attackers to launch cross-site scripting attacks...

Piwigo 'admin.php' SQL Injection Vulnerability

Piwigo is a photo album system based on MySQL5 and PHP5 development. Piwigo 'admin.php' suffers from a SQL injection vulnerability that allows remote attackers to exploit the vulnerability to submit specially crafted SQL queries to manipulate or obtain database data...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...

Sql injection

SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...

Sql injection

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

CVE-2015-1517

SQL injection vulnerability in Piwigo before 2.7.4, when all filters are activated, allows remote authenticated users to execute arbitrary SQL commands via the filterlevel parameter in a "Refresh photo set" action in the batchmanager page to admin.php...

CVE-2015-2034

Affected software: Piwigo (PHP photo gallery script). Vulnerability: Cross-site scripting (XSS) in the administrative backend. Component/entry point: admin.php via the page parameter. Versions affected: Piwigo before 2.7.4. Root cause/impact: Allows remote attackers to inject arbitrary web script...

CVE-2015-1385

Cross-site scripting XSS vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmincategoryfeeds.php page to...