DaloRadius - Multiple Vulnerabilities

No description provided by source. ------------------------------------------------------------------------- Software : DaloRadius SQLi / CSRF / XSS Author : Saadat Ullah , [email protected] Author home : http://security-geeks.blogspot.com Date : 15/3/13 Vendors : http://www.daloradius.co...

WordPress Occasions Plugin 1.0.4 - CSRF Vulnerability

No description provided by source. html !-- Exploit Title: WordPress Occasions Plugin 1.0.4 CSRF Google Dork: inurl:/wp-content/plugins/occasions Date: 18.03.2013 Exploit Author: m3tamantra http://m3tamantra.wordpress.com/blog Vendor Homepage: http://wordpress.org/extend/plugins/occasions/ Softwa...

Wordpress Theme Fusion Arbitrary File Download Vulnerability

This exploit allows attacker to download any writable file from the server Usage Info Put the path of the file in the file's field of the exploit ,then click "Download" button then you get the file directly Title : Wordpress Theme Fusion Arbitrary File Download Vulnerability Author : Aloulou Date...

osCmax跨站请求伪造漏洞

Bugtraq ID:66272 osCmax是一款免费的PHP开源商城。 osCmax存在跨站请求伪造漏洞，允许远程攻击者构建恶意URI，诱使用户解析，可以目标用户上下文执行恶意操作，如添加管理员账户。 0 osCmax 2.5.X 目前没有详细解决方案提供： http://www.oscmax.com/ html form method="post" name="newmember" action="http://127.0.0.1/catalog/admin/adminmembers.php?action=membernewpage=1mID=1" input...

XSS when using Spring MVC

When a programmer does not specify the action on the Spring form, Spring automatically populates the action field with the requested uri. An attacker can use this to inject malicious content into the form...

PHPSurveyor Shell Upload

-= G4eL =- Exploit Title: PHPSurveyor - Shell Upload Exploit Author: G4eL Date: 26/12/2013 Product: PHPSurveyor Official Site: http://www.limesurvey.org/ Risk Level: High /admin/templates.php - File Upload URL SITE = Default directory of PHPSurveyor Example : http://site.com/survey/ File Uploaded...

XOOPS 2.5.6 CSRF Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

Multiple Vulnerabilities in KrisonAV CMS

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in KrisonAV CMS, which can be exploited to perform cross-site scripting and cross-site request forgery attacks. 1 Cross-Site Scripting XSS vulnerability in KrisonAV CMS: CVE-2013-2712 The vulnerability exists due to...

CVE-2012-6312

Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...

phpweb finished website full version through the kill injection vulnerability and fix-vulnerability warning-the black bar safety net

Keywords: inurl:webmall/detail. php? id Data table: pwnbaseadmin About to get shell 首先 登录 后台 admin.php See the upload. php source code analysis for an afternoon, and then about understand that although the upload where only allowed to upload gif,jpg,png,bmp four types of files, but not the file...

Arb Blog 0.1 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Arb Blog 0.1 CSRF Vulnerability Author: Mr.731MY Vendor or Software Link: http://www.dev-arb.com/uploads/Files/dev-arb.com1341094517.ZIP Version: 0.1 Category:: WebApp Google dork: intext:All Right Resrved For Dev-Arb.com And...

Microcart 1.0 Cross Site Scripting

/-----------------------------------------------------------------\ | Microcart 1.0 Admin Cross-Site Scripting Security Vulnerability | -----------------------------------------------------------------/ Summary ======= Microcart 1.0 is subject to a cross-site scripting vulnerability. A generic...

CVE-2010-5087

SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 allows remote attackers to bypass the cross-site request forgery CSRF protection mechanism and hijack the authentication of administrators via vectors related to "form action requests" using a controller...

CVE-2010-5087

CVE-2010-5087 affects SilverStripe 2.3.x prior to 2.3.10 and 2.4.x prior to 2.4.4. The issue allows remote attackers to bypass CSRF protection and hijack administrator sessions via vectors related to form action requests handled by a controller. Impact is authenticated session hijacking through C...

WordPress Plugin Zingiri Web Shop 2.4.0 - Multiple Cross-Site Scripting Vulnerabilities

WordPress Plugin Zingiri Web Shop 2.4.0 - Multiple Cross-Site Scripting Vulnerabilities Wordpress Zingiri Web Shop Plugin '; Exploit: http://localhost/wordpress/?page=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E 'page' variable isn't properly sanitized before being used. STORED XSS P...

idev-Blog 1.0 Cross Site Request Forgery

Exploit Title: idev-Blog 1.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-blog/admin/ Greetz: Inj3ct0r Exploit DataBase 1337day.com...

idev-LinkDirectory 1.0 Cross Site Request Forgery

Exploit Title: idev-LinkDirectory 1.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-linkdirectory/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com...

Social Bookmark CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Social Bookmark CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/social-bookmark-script/28963/ Category:: webapps Demo : http://www.e-soft24.com/scripts/social-bookmark/admin Greetz: Inj3ct0r...

javascript: URLs in chrome documents (MFSA 2011-08)

The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remot...

XSRF (CSRF) in F3Site

Vulnerability ID: HTB22757 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinf3site.html Product: F3Site Vendor: COMPMaster http://dhost.info/compmaster/ Vulnerable Version: 2011 alfa 1 and probably prior versions Vendor Notification: 21 December 2010 Vulnerability Type: CSRF Cross-Site Reques...