1674 matches found
StopTheHacker: Information Disclosure (FPD) - stopthehacker.com
Hi, I found a information disclosure vulnerabilityFull path disclosure Vulnerable link : http://www.stopthehacker.com/wp-includes/rss-functions.php You can see in the page the path of the site Fatal error: Call to undefined function deprecatedfile in...
Localize: Full Path Disclosure / Info Disclosure in Importing XML Section!
Hello, I found another information disclosure vulnerability/Full Path Disclosure on your application. now its on Import XML Section Proof of Concept ------------------------- POST : http://www.localize.io/import/ project ID POST CONTENT: -----------------------------97823247315770\r\n...
Localize: Full Path Disclosure / Info Disclosure in Creating New Group
Hi, I found another information disclosure vulnerability/Full Path Disclosure on your application. this time its on Creating New Group Section. Proof of Concept ------------------------- GET : http://www.localize.io/pages/createproject/ project ID POST CONTENT: CSRFToken=TOKEN...
Localize: Full Path Disclosure (FPD) in www.localize.io
Hi, I found an information disclosure vulnerability/Full Path Disclosure on your application. Proof of Concept ------------------------- GET : http://www.localize.io/pages/createproject/ project ID POST CONTENT: CSRFToken=TOKEN...
Localize: Full path disclosure
I signed up for localize with [email protected], and localize sent me a verification link which was: http://www.localize.io/verify/e6be646b24pdd3w6d5c27ppa9a267ee7 When I visited that link I found it was showing the following error: Fatal error: Call to a member function...
Concrete CMS: FULL PATH DISCLOSUR
Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...
JoomShopping 4.4.2 - Multiple XSS & FPD Vulnerabilities
Joomla extension called JoomShopping suffers on multiple Cross Site Scripting and Full Path Disclosure vulnerabilities because of poor POST & GET parameter filtration. Title: JoomShopping - Multiple XSS & FPD Date: 13.04.14 Vendor: joomshopping.com Demo: demo.joomshopping.com Dork:...
Khan Academy: Full Path Disclosure on [smarthistory.khanacademy.org]
Hello, I have found a full path disclosure on a website that runs a wordpress installation. There isn't much to explain about this bug, as it's pretty self explanatory. What an attack can do with this bug is identify the full path, and the user the site is running under. If the attacker finds a...
WordPress Js-Multi-Hotel 2.2.1 XSS / DoS / Disclosure / Abuse
Hello list! There are multiple vulnerabilities in Js-Multi-Hotel plugin for WordPress. Earlier I wrote about two other vulnerabilities. These are Abuse of Functionality, Denial of Service, Cross-Site Scripting and Full path disclosure vulnerabilities in Js-Multi-Hotel plugin for WordPress. There...
Joomla JoomLeague 2.1.12 XSS / XML Injection
Hello list! These are Denial of Service, XML Injection, Cross-Site Scripting, Full path disclosure and Insufficient Anti-automation vulnerabilities in JoomLeague plugin for Joomla. These vulnerabilities are in Google Maps plugin for Joomla, which is used in this plugin. In 2013-2014 I wrote...
Atmail Webmail => 7.2 - Multiple XSS & FPD Vulnerabilities
Atmail is a platform which main purposes is to... send and receive emails - anyway, latest versions suffers on multiple Cross Site Scripting vulnerabilities because of poor content and variables filtration. Cheers. Title: Atmail Webmail =7.2 - Multiple XSS & FPD Date: 01.27.2014 Vendor: atmail.co...
b2evolution CMS 5.0.6 - XSS & FPD Vulnerabilities
Latest b2evolution CMS suffers on multiple Full Path Disclosure and Cross Site Scripting vulnerabilities. Title: b2evolution CMS 5.0.6 - XSS & FPD Version: 5.0.6 Latest ATM Vendor: b2evolution.net - en.wikipedia.org/wiki/B2evolution Demo: demo3.b2evolution.net Date: 01.25.2014 Contact:...
ZenPhoto 1.4.4 Path Disclosure / SQL Injection
----------------------------------------- 0-DAY Aint DIE | No Priv8 | KedAns-Dz ----------------------------------------- ---------------------------- K |................| . h |.......................| A a |.......................| N l |.....................| S E |.......................| e D...
Joomla Music Collection - XSS & FPD Vulnerabilities
Joomla Extension called Music Collection suffers on multiple Full Path Disclosure and Cross Site Scripting vulnerabilities because of poor content and variables filtration. Title: Joomla Music Collection - XSS & FPD Version: 2.4.0 Latest ATM -...
Maian Uploader 4.0 XSS / SQL Injection / Disclosure
----------------------------------------- 0-DAY Aint DIE | No Priv8 | KedAns-Dz ----------------------------------------- ---------------------------- K |................| . h |.......................| A a |.......................| N l |.....................| S E |.......................| e D...
ZenPhoto v1.4.4 (SQLi/Disclosure) Multiple Vulnerabilities
ZenPhoto version 1.4.4 is suffer from multiple vulnerabilities remote attacker can use some MySQL bug in &date= and exploit it as SQL Injection ,and access to some files and get errors with the Full Path of this files and use it to disclosure the target full path...
Maian Uploader v4.0 <= (SQLi/Disclosure/XSS) Vulnerabilities
Maian Uploader v4.0 is suffer from multiple vulnerabilities remote attacker can exploit some bugs like SQL Injection , XSS and disclosure the target full path. ----------------------------------------- 0-DAY Aint DIE | No Priv8 | KedAns-Dz -----------------------------------------...
Joomla Zap Weather FPD & Zap Calendar跨站脚本漏洞
No description provided by source. Title - Joomla Zap Weather FPD & Zap Calendar XSS Date: 01.21.2014 Vendor: zcontent.net extensions.joomla.org/extensions/owner/cogliano Versions - Z Weather v9 & Zap Calendar v4.0 Latests ATM Contant: smashatdevilteam.pl Zap Weather PoC -...
MyBB 1.6.12 - Admin Panel FPD & Multiple XSS
Latest mybb forums suffers on multiple persistent cross site scripting vulnerability and single full path disclosure. Probably, there are more bugs because of poor content filtration. Title: MyBB 1.6.12 - Admin Panel FPD & Multiple XSS Date: 01.11.2014 Tested on: Linux 3.7-trunk-686-pae 1 SMP...
Cubic CMS多个安全漏洞
Cubic CMS是一款内容管理系统。 由于/login.usuario没有正确过滤传递的'login'和'pass' POST参数的用户输入，允许远程攻击者注入或操纵SQL查询。 0 Cubic CMS 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.cubicfactory.com/ I. BACKGROUND ------------------------- "CUBIC CMS" is a non-free content management system for websites and portals o...