8126 matches found
Moodle 'mod/forum:canposttomygroups' security bypass vulnerability
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security bypass vulnerability exists in Moodle. An attacker could exploit this...
SDCMS论坛存在高危漏洞可getshell，影响其大量系统
简要描述： shell 详细说明： 论坛存在解析漏洞，可利用该漏洞getshell 漏洞证明： 该论坛为aspx类型的论坛，但还可以做php容器可以执行php文件，且存在php解析漏洞。。然后就没有然后了。。。 找到论坛需要注册码：http://bbs.sdcms.cn/，十块钱一个。。。。 屌丝买不起，找到一个手机号昵称的用户：15837309973，手机号当用户名和密码居然登进去了。。 在头像上传处直接上传一张图片马，找到路径：http://bbs.sdcms.cn/max-temp/avatar/28a1ddde7e6a4ecbaf56e54ad06a3406.jpg...
MyBB Detection (HTTP)
HTTP based detection of MyBB. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.111023";...
Malware And Hacking Forum Seized, Dozens Arrested
The FBI and other law enforcement agencies have arrested more than 70 people suspected of carrying out cyber criminal activities associated with one of the most active underground web forums known as Darkode. Darkode, also used by notorious Lizard Squad, was an online bazaar for cyber criminals...
Feds Detail Shutdown of Cybercrime Forum Darkode
Officials worldwide this week culminated an 18-month effort to take down Darkode, a cybercrime forum where hackers fraternized, shared malware, credit card information and more. The campaign, dubbed Operation Shrouded Horizon, resulted in the arrest of 28 hackers and 27 house searches across 18...
Just A Forum 2.1.1 Cross Site Scripting
| Title : Just aForum v2.1.1 XSS Vulnerability | Author : indoushka | email : [email protected] | Tested on: windows 8.1 Français V.Pro | Download : http://www.dl.persianscript.ir/script/JustaForumv2.1.1PersianScript.ir.rar ======================================= Poc : Put in the search bo...
DMX FORUM 2.1a Configuration Disclosure
| Title : DMX FORUM v2.1a Config Disclosure Vulnerability | Author : indoushka | email : [email protected] | Dork : © DMX FORUM v2.1a | Tested on: windows 8.1 Français V.Pro | Bug : by pass | Download : scripts.toucharger.com/fiches/scripts/dmx-forum/3392.htm...
WordPress Plugin WP Symposium 15.1 - '&show=' SQL Injection
======================================================================= title: SQL Injection product: WordPress WP Symposium Plugin vulnerable version: 15.1 and probably below fixed version: 15.4 CVE number: CVE-2015-3325 impact: CVSS Base Score 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P homepage:...
WordPress Plugin WP Symposium 15.1 - show SQL Injection
WordPress Plugin WP Symposium 15.1 - show SQL Injection ======================================================================= title: SQL Injection product: WordPress WP Symposium Plugin vulnerable version: 15.1 and probably below fixed version: 15.4 CVE number: CVE-2015-3325 impact: CVSS Base...
WordPress Plugin WP Symposium 'forum.php' SQL Injection Vulnerability
WordPress is a blogging platform developed using the PHP language, users can set up their own weblogs on servers that support PHP and MySQL databases.WP Symposium plugin for WordPress is an application plugin for wordpress. A SQL injection vulnerability exists in the WP Symposium plugin for...
WP Symposium Plugin for WordPress forum.php 'show' Parameter SQL Injection (Version Check)
The WordPress WP Symposium Plugin installed on the remote host is affected by a SQL injection vulnerability due to a failure to properly sanitize user-supplied input to the 'show' parameter of the forum.php script. An unauthenticated, remote attacker can exploit this issue to launch a SQL injecti...
WordPress Mingle Forum Plugin <= 1.0.28 - Multiple Vulnerabilities
This plugin is prone to cross site scripting and full path disclosure vulnerabilities. Solution Update plugin...
WordPress Mingle Forum Plugin <= 1.0.33 - Cross Site Scripting
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...
WordPress Forum Plugin <= 2.4 - SQL Injection
Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...
Shopify: Stored XSS in the Shopify Discussion Forums
Hi Shopify Security Team, There is Stored XSS in the Shopify Discussion Forums.Under ecommerce.shopify.com, in shopify-discussion The STORED XSS is present. The Stored XSS can easily be produced Every time. To Produce the XSS Vulnerability, I created a New Topic Under the shopify-discussions in t...
Dokeos 'forum' and 'origin' cross-site scripting vulnerabilities
Dokeos is an open source online education and course management system . The system supports file uploading , courseware production , notification and other teaching support functions. Dokeos 1.8.4 and previous versions of cross-site scripting vulnerabilities , the vulnerability stems from...
IP. Board <= 3.4.7 SQL Injection analysis-vulnerability warning-the black bar safety net
IPB stands for Invision Power Board is a PHP Development Forum program, foreign used more widely. In its 3. 4. 7 version and the previous presence of a SQL injection vulnerability, this article to its analysis. poc link http://seclists.org/fulldisclosure/2014/Nov/20 !/ usr/bin/env python Sunday,...
phpok（safe_html)绕过导致储存型xss
简要描述： phpok（论坛BBS功能） 存储型xss 详细说明： public function safehtml$content,$clearurl='' $content = pregreplacecallback'//isU',array$this,'cleanxsson',$content; //清除带src和href里的信息 $content = pregreplacecallback"//isU",array$this,'cleanxssscript',$content; //清除src传递没有引号的数据 $content =...