WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download

WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download Title: Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-02 Download Site: https://wordpress.org/plugins/wp-swimteam Vendor: Mike Walsh...

KC-Wiki 1.0 /simplest/wiki.php 任意文件下载漏洞

No description provided by source...

WordPress Plugin aspose-doc-exporter 1.0 - Arbitrary File Download

|||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | + Exploit Title:Wordpress aspose-doc-exporter Plugin Arbitrary File Download Vulnerability | | + Exploit Author: Ashiyane Digital Security Team | | + Vendor Homepage :...

WordPress Aspose Doc Exporter File Download

|||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | + Exploit Title: Wordpress aspose-doc-exporter Plugin Arbitrary File Download Vulnerability | | + Exploit Author: Ashiyane Digital Security Team | | + Vendor Homepage :...

A user is a particularly large amount of educational classes CMS arbitrary File Download-vulnerability warning-the black bar safety net

Vulnerabilities page: http://www.hbycscjzx.com//OperationManage/DownFile.aspx First register a regular account In personal writing news, when inserted into the attachment capture. You can see the following content code area POST /OperationManage/DownFile. aspx HTTP/1.1 Host: www.hbycscjzx.com...

SrunDisk /user_space.php 任意文件下载漏洞

No description provided by source...

WordPress Download Manager Arbitrary File Download

WordPress Download Manager Plugin - Arbitrary File Download CWE: CWE-98 Risk: High Author: Hugo Santiago dos Santos Contact: [email protected] Date: 25/10/2014 Vendor Homepage: https://wordpress.org/plugins/download-manager/ Tested on: Windows 7 and Gnu/Linux Google Dork:...

WordPress MichaelCanthony theme Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Date: 2014-09-11 Google Dork : inurl:/wp-content/themes/MichaelCanthony/ Exploit Author: Mr.Doel Vendor Homepage: http://michaelcanthony.com Tested on: Windows 7 & Linux POC :...

WordPress Theme Antioch - download.php Arbitrary File Download

WordPress Theme Antioch - download.php Arbitrary File Download source: https://www.securityfocus.com/bid/69673/info Antioch theme for Wordpress is prone to an arbitrary file-download vulnerability. An attacker can exploit this issue to download arbitrary files from the web server and obtain...

Filedownload 0.1 - (download.php) Remote File Disclosure

The filedownload WordPress plugin was affected by a download.php Remote File Disclosure security vulnerability...

用友某通用学习管理系统设计不当致用户信息泄漏(可批量)

简要描述： 已经有大牛呵呵过了，至于是谁..自己猜去 详细说明： WooYun: 某通用型在线学习管理系统存在任意文件上传及任意文件下载漏洞 , WooYun: 某通用型在线学习管理系统存在任意文件上传漏洞（另一种奇葩姿势） 用友的e-Learning，wefgod大牛提交过，这里摘取一下他之前提供的弱口令： 首先需要一个低权限账号登录（反正没有验证码，设定好简单密码，按数字直接丢去暴了都没有问题） 给出几个默认或简单密码的： http://58.214.233.113:8800/lmsv5/ 00041013/123456 00041014/123456...

Zoomla /API/GetPageHtml.aspx 任意文件下载漏洞

No description provided by source...

ibase <= 2.03 (download.php) Remote File Disclosure Vulnerability

No description provided by source. Name: AFD i-base = 2.03 Author: Dyshoo Vendor: http://www.i-base.net/ Dork: inurl:ibase site:de http://site/ibase/zubehoer/download.php?filename=file Database config: http://site/ibase/zubehoer/download.php?filename=../config/configdb.php milw0rm.com 2008-07-24...

Blackboard Learning System 6.0 Dropbox File Download Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10515/info It is reported that Blackboard improperly allows users to download files posted in the 'Digital Dropbox'. Files in the dropbox are intended for the course administrators. The application does not verify that th...

NS_ASG 6.3 /debug/show_logfile.php 任意文件下载漏洞

No description provided by source...

Anymacro 邮件系统任意文件下载漏洞（需登陆）

简要描述： 详细说明： 在mailattrFw.php中 其中$Fcid可控，从客户端获取，可以通过../跳转字符，跳转到相应目录进行读取。。 如默认状态下$SESSION'maildir'为：/mail/xxx.com/xxx/Maildir/ $Fcid可设置为：../../../../../etc/passwd 即可读取passwd内容 漏洞证明：...

ezEIP 3 /download.ashx 任意文件下载漏洞

No description provided by source...

trs某系统任意文件下载漏洞第二弹

简要描述： 感觉挺严重的问题，存在的地方包括但是不局限银行、政府等行业。 详细说明： exp inforadar/jsp/util/filedownload.jsp?filePath=../../../../../../../etc/passwd exp2 http://inforadar.trs.com.cn/jsp/util/filedownload.jsp?filePath=c:%5Cboot.ini%00.xml 官方网站需要加个截断，就可以了 应该是神马雷达系统。 很多地方都有这问题。 但是google找不到多少个，因为很多都是二次开发，目录明改变了。 比如招行。。。...

o2micro minica_down.php 任意文件下载漏洞

网御神州、天融信、美国凹凸等vpn设备开发疑似源于同一套技术，其中的"/minicadown.php"文件可以再下载其它任意文件 网御神州、天融信、美国凹凸等vpn设备...

Cross site scripting

Cross-site scripting XSS vulnerability in the filedownload function in GNUBoard before 4.34.21 allows remote attackers to inject arbitrary web script or HTML via the filename parameter...