Keypasco Demo - Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application Keypasco Demo published at the 'play' market has multiple vulnerabilities...

Nextcloud: xss on demo.nextcloud.com due to outdated version

Hello. I found the possibility of introducing "html-tag" and of xss attack in the form of adding comments. Details video. Payload: Browser: Firefox 49.0 OS: Ubuntu 16.04...

Event Calendar PHP 1.5 SQL Injection Vulnerability

Exploit for php platform in category web applications ===================================================== Event Calendar PHP 1.5 - SQL Injection ===================================================== Vendor Homepage: http://eventcalendarphp.com/ Date: 21 Oct 2016 Demo Link :...

Spade - Android APK Backdoor Embedder

Quick and handy APK backdoor embedder with metasploit android payloads. Requirements metasploit Installation and execution Then you can download smap by cloning the Git repository: git clone https://github.com/suraj-root/spade.git cd spade/ ./spade.py Demo video Video YouTube: Download Spade...

Simple Blog PHP 2.0 - Multiple Vulnerabilities

Simple Blog PHP 2.0 - Multiple Vulnerabilities ===================================================== Simple Blog PHP 2.0 - CSRFAdd Post // Stored XSS ===================================================== Vendor Homepage: http://simpleblogphp.com/ Date: 13 Oct 2016 Demo Link :...

NetBilletterie 2.8 - Multiple Vulnerabilities

NetBilletterie 2.8 - Multiple Vulnerabilities Exploit Title: NetBilletterie 2.8 | Multiple Vulnerabilities Date: 14/07/16 Exploit Author: Wadeek Website Author: https://github.com/Wad-Deek Vendor Homepage: http://net-billetterie.tuxfamily.org/ Software Link:...

NetBilletterie 2.8 - Multiple Vulnerabilities

Exploit Title: NetBilletterie 2.8 | Multiple Vulnerabilities Date: 14/07/16 Exploit Author: Wadeek Website Author: https://github.com/Wad-Deek Vendor Homepage: http://net-billetterie.tuxfamily.org/ Software Link: https://sourceforge.net/projects/netbilletterie/files/ Demo Link:...

Nextcloud: URI scheme bypass in mail app lead to HTML content spoof and opener control

Bug When we load a HTML mail from mailbox via api, etc http://nextcloud/index.php/apps/mail/accounts//folders/SU5CT1g=/messages//html Our content will be passed to HTML Purifier to strip malicious XSS patterns. After that, an filter will apply to transform acceptable URI schemes http, https, ftp,...

Jndi injection and Spring RCE vulnerability analysis-vulnerability warning-the black bar safety net

Foreword Because before has been traveling, and haven't done the research, eleven during the re-focus of the 2 0 1 6 BlackHat the above subject, wherein jndi injection caught my attention, this paper mainly divided into the following 3 sections, the understanding of jndi, analysis jndi injection...

Forbiz Infoway CMS File Upload / Cross Site Scripting

================================================================================ Forbiz Infoway CMS - File Upload / Cross Site Scripting ================================================================================ Vendor Homepage: http://www.forbiz.co.in/ Date: 07/10/2016 Author: Ashiyane...

B2B Portal Script Blind SQL Injection

x========================================================================================================================================x | Title : B2B Portal Script Blind SQL Vulnerabilities | Software : B2B Portal Script | Vendor : http://www.i-netsolution.com/ | Demo :...

PHP Classifieds Rental Script - Blind SQL Injection

x========================================================================================================================================x | Title : PHP Classifieds Rental Script Blind SQL Vulnerabilities | Software : PHP Classifieds Rental Script | Vendor : http://www.i-netsolution.com/ | Demo :...

Joomla com_jsjobs SQL injection Vulnerability

Exploit for php platform in category web applications |✚✚✚✚✚✚✚✚✚✚✚✚✚✚✚✚✚✚✚✚✚✚✚ !! Exploit Title : Joomla comjsjobs SQL injection Vulnerability !! Exploit Author : xBADGIRL21 !! Dork : inurl:index.php?option=comjsjobs !! Vendor Homepage : http://www.joomsky.com !! MyBlog :...

Joomla Topics 1.5.12 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Joomla comtopics SQL injection Exploit Author : xBADGIRL21 Dork : inurl:index.php?option=comtopics Category: Webapps version: 1.5.12 Tested on: Windows skype:xbadgirl21 Date: 2016/07/08 video Proof Youtube :...

Joomla com_threate 1.1.4 SQL injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Joomla comthreate 1.1.4 SQL injection Exploit Author : xBADGIRL21 Dork : index.php?option=comthreate version: 1.1.4 Vendor Homepage : http://joomlic.com/ Tested on: Windows skype:xbadgirl21 Date: 2016/07/09 video Proof :...

Wordpress force download Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress force download Arbitrary File Download Dork 1 : inurl:force-download.php?file=wp-content/uploads Dork 2 : inurl:wp-content/uploads inurl:force-download.php?file= Vendor Homepage : http://elouai.com/force-download.php...

WordPress Directory Themes Arbitrary Shell Upload Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress Theme Directory Arbitrary Shell Upload Vulnerability Exploit Author : xBADGIRL21 Dork : inurl:/wp-content/themes/Directory/ Vendor Homepage : https://templatic.com/ version : 2.0.16 - 2.0.14 & maybe high or lower Test...

Bezaat Script V2 Arbitrary Shell Upload Vulnerability

Exploit for php platform in category web applications Exploit Title : Bezaat Script V2 Arbitrary Shell Upload Vulnerability Exploit Author : xBADGIRL21 Dork 1 : index of /SystemImagesads/ Dork 2 : Powed by Greenit Egypt for Information Technology Vendor Homepage :...

KV Site Admin CMS 3.0 SQL injection Vulnerability

Exploit for php platform in category web applications Exploit Title : KV Site Admin CMS 3.0 SQL injection Vulnerability Exploit Author : xBADGIRL21 Dork : e.World Technology Ltd. All rights reserved "Admin Area - Version 3.0" Version: 3.0 MyBlog: http://xbadgirl21.blogspot.com Tested on: BackBox...

WordPress KBoard Cross Site Scripting

Exploit Title : WordPress Plugin KBoard - Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.cosmosfarm.com/products/kboard Category Webapps Tested on Win Version : Before 4.4 Date 2016/09/26 PoC =Cross Site Scripting : Payload : 1" onmouseover=prompt"Persian"...