Form Lightbox - Arbitrary Option Update Leading to Admin Account

This is a plugin that is no longer in the WordPress repository, however, is still in use on some sites. With this vulnerability an attacker can update any option in the WordPress database. This includes gaining an admin access. Using the file ajax.php that contains the following line: updateoptio...

74cms m\plus\ajax.php key参数 SQL注入

No description provided by source...

JobScript Remote Code Execution

!C:/Python27/python.exe -u JobScript Remote Code Execution Exploit Vendor: Jobscript Product web page: http://www.jobscript.in Affected version: Unknown Summary: JobScript is inbuilt structured website was developed in PHP and MySQL database. It's a complete job script for those who wants to star...

JobScript Open Redirection And Arbitrary Code Execution Vulnerability

Summary JobScript is inbuilt structured website was developed in PHP and MySQL database. It's a complete job script for those who wants to start a professional job portal website like naukri.com, monster.com, clickjobs.com or any such major job portals. Jobscript was designed and developed with t...

PHP Utility Belt remote code execution vulnerability verification and analysis-vulnerability warning-the black bar safety net

! PHP Utility Belt is a tool for PHP application developers use a set of tools that can be used to test regular expressions and observed with pregmatch and pregmatchall function to match the observed pregreplate the result of the function; contains two words, two numbers with a capital letter and...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the formfields parameter in a 1 doedit or 2 doinsert action to wp-admin/admin-ajax.php...

Zen Cart Arbitrary File Inclusion Vulnerability

Zen Cart is open source shopping cart software. An arbitrary file inclusion vulnerability exists in Zen Cart. Due to a lack of filtering in the "/ajax.php" script directory traversal sequence in the "act" HTTP GET parameter, an attacker can exploit the vulnerability to execute arbitrary PHP code...

PHP Utility Belt - Remote Code Execution

PHP Utility Belt - Remote Code Execution Exploit Title : PHP utility belt Remote Code Execution vulnerability Author : WICS Date : 8/12/2015 Software Link : https://github.com/mboynes/php-utility-belt Overview: PHP utility belt is a set of tools for PHP developers. Install in a browser-accessible...

PHP Utility Belt - Remote Code Execution

Exploit Title : PHP utility belt Remote Code Execution vulnerability Author : WICS Date : 8/12/2015 Software Link : https://github.com/mboynes/php-utility-belt Overview: PHP utility belt is a set of tools for PHP developers. Install in a browser-accessible directory and have at it. ajax.php is...

PHP Utility Belt Remote Code Execution

Exploit Title : PHP utility belt Remote Code Execution vulnerability Author : WICS Date : 8/12/2015 Software Link : https://github.com/mboynes/php-utility-belt Overview: PHP utility belt is a set of tools for PHP developers. Install in a browser-accessible directory and have at it. ajax.php is...

Wordpress VideoWhisper Video Presentation plugin XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress plugin videowhisper-video-presentation XSS Vulnerability Vendor or Software Link: https://wordpress.org/plugins/videowhisper-video-presentation/ Google dork: inurl:/wp-content/plugins/videowhisper-video-presentation Th...

Wordpress Plugin Store Locator Plus 4.2.23 Email Injection

如果我们拥有有效的“钥匙”就可以发送邮件给任何人File: store-locator-le\include\send-email.phpif !wpverifynonce$REQUEST'valid','em' die; $messageheaders = "From: "$GET'emailname'"...

innovations-archive.aphp.fr. XSS vulnerability

Open Bug Bounty ID: OBB-86803 Description| Value ---|--- Affected Website:| innovations-archive.aphp.fr. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS...

prehopitalnecker.aphp.fr. XSS vulnerability

Open Bug Bounty ID: OBB-86795 Description| Value ---|--- Affected Website:| prehopitalnecker.aphp.fr. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Preventio...

ottpi-archive.aphp.fr. XSS vulnerability

Open Bug Bounty ID: OBB-86620 Description| Value ---|--- Affected Website:| ottpi-archive.aphp.fr. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention...

omsinc.in XSS vulnerability

Vulnerable URL: http://www.omsinc.in/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Rahul Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 15379222 Google Pagerank| 0 VIP...

coorgvacations.in XSS vulnerability

Vulnerable URL: http://coorgvacations.in/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Rahul Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 15376895 Google Pagerank| 0...

vayavyalabs.com XSS vulnerability

Vulnerable URL: http://vayavyalabs.com/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Rahul Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1659207 Google Pagerank| 3 VIP...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a saveWorkerPeek action...

CVE-2015-6545

Cross-site request forgery CSRF vulnerability in ajax.php in Cerb before 7.0.4 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a saveWorkerPeek action...