3210 matches found
MiwoFTP - File & Folder Manager <= 1.0.4 - Arbitrary File Disclosure
A hook is added to ‘init’ in the file ‘miwoftp/miwoftp.php’. This hook is triggered whenever a user visits the front end of the site. The function specified in this hook will proceed to allow the user to download a file within the scope of the home directory of the site. Various values from the G...
MiwoFTP - File & Folder Manager <= 1.0.4 - Arbitrary File Disclosure
A hook is added to ‘init’ in the file ‘miwoftp/miwoftp.php’. This hook is triggered whenever a user visits the front end of the site. The function specified in this hook will proceed to allow the user to download a file within the scope of the home directory of the site. Various values from the G...
Concrete CMS: Self Xss on File Replace
In File manager there is an Replace option to replace files from three resources . 1. from computer 2.incoming 3.Remote files For remote files if we put http://example.com/" in the url box It reflects xss. Poc: https://www.dropbox.com/s/m7pb9wiwxix1oyu/replacexss.mkv?dl=0 Thanks...
EUVD-2015-1559
Multiple cross-site scripting XSS vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 horder, 2 jakcatid, 3 jakcontent, 4 jakcss, 5 jakdeletelog, 6 jakemail, 7 jakextfile, 8 jakfile, 9 jakhookshow, 10 jakimg, 11 jakjavascript, 12...
DAws - Advanced Web Shell (Windows/Linux)
There's multiple things that makes DAws better than every Web Shell out there: 1. Bypasses Disablers; DAws isn't just about using a particular function to get the job done, it uses up to 6 functions if needed, for example, if shellexec was disabled it would automatically use exec or passthru or...
CVE-2015-1053
Cross-site scripting XSS vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/filemanager/filemanager/editfile...
vBulletin MicroCART 1.1.4 - Arbitrary File(s) Deletion, SQL Injection & XSS Vulnerabilities
Exploit for php platform in category web applications Exploit Title: vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion, SQL Injection & XSS Date: January 8, 2015 Exploit Author: Technidev https://technidev.com Vendor Homepage: https://vbulletin.com Software Link:...
Installatron GQ File Manager SQL Injection Vulnerability
Installatron GQ File Manager is a web-based GQ file manager from Installatron. Installatron GQ File Manager 0.2.5 suffers from a SQL injection vulnerability that allows remote attackers to execute arbitrary commands via indexphp creation parameters...
CVE-2014-9445
SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php. NOTE: this can be leveraged for cross-site scripting XSS attacks by creating a file that generates an error...
Sql injection
SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php. NOTE: this can be leveraged for cross-site scripting XSS attacks by creating a file that generates an error...
CVE-2014-9445
SQL injection vulnerability in incl/create.inc.php in Installatron GQ File Manager 0.2.5 allows remote attackers to execute arbitrary SQL commands via the create parameter to index.php. NOTE: this can be leveraged for cross-site scripting XSS attacks by creating a file that generates an error...
CVE-2014-9445
The CVE-2014-9445 entry describes a SQL injection in Installatron GQ File Manager 0.2.5, specifically in incl/create.inc.php, exploitable via the create parameter to index.php. This allows remote SQL command execution and can be leveraged to trigger a related XSS condition by causing an error (pe...
Concrete CMS: Stored XSS in adding fileset
Hello I found XSS and CSRF in Concrete5 5.7.3 Adding fileset function have CSRF vuln so I think easy to attack. PoC is below 1.Upload one file in file manager /conc/index.php/dashboard/files 2.Open the page like this ---------------------...
GQ File Manager 0.2.5 Cross Site Scripting / SQL Injection
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: GQ File Manager - Sql Injection - Cross Site Scripting Vulnerability's Date: 19/12/2014 Url Vendor: http://installatron.com/phpfilemanager Vendor...
GQ File Manager 0.2.5 Sql Injection / Cross Site Scripting Vulnerabilities
GQ File Manager version 0.2.5 suffers from cross site scripting and remote SQL injection vulnerabilities. Exploit Title: GQ File Manager - Sql Injection - Cross Site Scripting Vulnerability's Date: 19/12/2014 Url Vendor: http://installatron.com/phpfilemanager Vendor Name: GQ File Manager Version:...
GQ File Manager 0.2.5 - Multiple Vulnerabilities
GQ File Manager 0.2.5 - Multiple Vulnerabilities -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: GQ File Manager - Sql Injection - Cross Site Scripting Vulnerability's Date: 19/12/2014 Url Vendor...
GQ File Manager 0.2.5 - Multiple Vulnerabilities
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: GQ File Manager - Sql Injection - Cross Site Scripting Vulnerability's Date: 19/12/2014 Url Vendor: http://installatron.com/phpfilemanager Vendor...
File Manager 4.2.10 iOS - Code Execution Vulnerability
No description provided by source. Document Title: =============== File Manager v4.2.10 iOS - Code Execution Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1343 Release Date: ============= 2014-10-21 Vulnerability Laboratory ID VL-ID:...
Croogo 2.0.0 - Arbitrary PHP Code Execution Exploit
No description provided by source. !/usr/bin/env python Croogo 2.0.0 Arbitrary PHP Code Execution Exploit Vendor: Fahad Ibnay Heylaal Product web page: http://www.croogo.org Affected version: 2.0.0 Summary: Croogo is a free, open source, content management system for PHP, released under The MIT...