PT-2014-5973

Name of the Vulnerable Software and Affected Versions SS Downloads plugin versions prior to 1.5 Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via the title parameter in the templates/download.php file. Recommendations For version...

ZPanel <= 10.0.1 CSRF, XSS, SQLi, Password Reset

No description provided by source. Exploit Title: ZPanel = 10.0.1 CSRF, XSS, SQLi, Password Reset Date: 04/11/2012 Exploit Author: pcsjj Vendor Homepage: http://www.zpanelcp.com/ Version: 10.0.1 Software Link: http://sourceforge.net/projects/zpanelcp/files/latest/download Downloads: 90,382 CVE :...

PHP-Nuke 8.0 Downloads Module 'query' Parameter Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/35180/info PHP-Nuke is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

RMSOFT Downloads Plus (rmdp) 1.5/1.7 Module for XOOPS search.php key Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/30620/info RMSOFT Downloads Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code ...

RMSOFT Downloads Plus (rmdp) 1.5/1.7 Module for XOOPS down.php id Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/30620/info RMSOFT Downloads Plus is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code ...

phpBB Insert User Mod <= 0.1.2 - Remote File Include Exploit

No description provided by source. !/usr/bin/perl PHPBB insert user 0.1.2 Class: Remote File Include Vulnerability Patch: unavailable Date: 2006/10/12 Remote: Yes Type: high Site: http://www.grahameames.co.uk/phpbb/downloads/insertuser0.1.2.zip...

PHP-Nuke 6.5 - Multiple Downloads Module SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/7588/info PHP-Nuke is reportedly prone to multiple SQL injection vulnerabilities in the Downloads module. Exploitation could allow for injection of malicious SQL syntax, resulting in modification of SQL query logic or oth...

phpBB Security <= 1.0.1 (php_security.php) Remote File Include Exploit

No description provided by source. !/usr/bin/perl phpBB Security 1.0.1 Class: Remote File Include Vulnerability Date: 2006/10/12 Remote: Yes Type: high Site: http://www.phpbb-amod.com/downloads/phpBBSecurity.zip...

GREED 0.81 GRX File List Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12034/info greed Get and Resume Elite Edition is prone to unauthorized command execution. This issue is exposed when the application processes a GRX file list that specifies shell metacharacters and commands in file names...

PHP-Nuke Downloads Module - 'sid' Parameter SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/27932/info The Downloads module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an...

CMSimple 3.1 - Local File Inclusion / Arbitrary File Upload Exploit

No description provided by source. pre CMSimple 3.1 Local File Inclusion / Arbitrary File Upload download: http://www.cmsimple.org/?Downloads dork: Powered by CMSimple author: [email protected] homepage: http://irk4z.wordpress.com Local File Inclusion : http://host/path/index.php?sl=file%00...

PHP-Nuke 6.x/7.x Downloads Module Lid Parameter Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13011/info It is reported that the PHP-Nuke 'Downloads' module is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. This...

DaFun Spirit 2.2.5 - Multiple Remote File Include Vulnerability

No description provided by source. \|/// \ - - // @ @ ----oOOo---oOOo-------------------------------------------------- DaFun Spirit 2.2.5 Multiple Remote File Include Vulnerability Script: http://code.google.com/p/dafunspirit/downloads/list Author: mat Mail: [email protected]...

Sendmail 8.12.6 Trojan Horse Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5921/info Reportedly, the server hosting sendmail, ftp.sendmail.org, was compromised recently. It has been reported that the intruder made modifications to the source code of sendmail to include Trojan Horse code. Downloa...

vBulletin Secure Downloads 2.0.0r - SQL Injection Vulnerability

No description provided by source. vBulletin Mode Secure Downloads v2.0.0r SQL Injection Vulnerability Mod : http://www.1src.com/freeware/download.php?id=1880 Author : Cn4phux PoC : URL.com/fileinfo.php?id=SQL :...

PostNuke 0.6/0.7 Downloads Module TTitle Cross-site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8374/info It has been reported that a cross site scripting vulnerability exists in the Downlaods and WebLinks modules of PostNuke. It is possible that an attacker may construct a link containing malicious script code that...

Active Collab "chat module" <= 2.3.8 - Remote PHP Code Injection Exploit

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3...

SkyPortal Downloads Manager 1.1 - Remote Contents Change Vuln

No description provided by source. @=======================================@ ====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG===== @=======================================@ @=Author : ByALBAYX @=Website : WWW.C4TEAM.ORG @=From : Turkish @=======================================@ @=Script :SkyPortal...

chCounter <= 3.1.3 - SQL Injection Vulnerability

No description provided by source. !/usr/bin/python Exploit Title: chCounter = 3.1.3 SQLInjection Date: 2010/11/18 Author: Matias [email protected]. Software Link: http://chcounter.org/chCounter3/getfile.php?id=5 Version: 3.1.3 Tested on: Ubuntu Server 10.04 with apache...

WordPress Paid Downloads plugin <= 2.01 SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress Paid Downloads plugin = 2.01 SQL Injection Vulnerability Date: 2011-09-07 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/paid-downloads.2.01.zip Version: 2.01 tested...