Xshop Cross Site Scripting

Exploit Title: Iran XshoP XSS Vulnerability Google Dork: Dork Is PerSian ! See End Of Demo ! Date: 2014-03-27 Exploit Author: Medrik Vendor Homepage: http://www.xshopsaz.ir/ Tested on: Windows ----------------- Proof : Vulnerability in : index.php Page With ftp Paramter ! Exploit :...

PTCeffect 4.6 /index.php 本地文件包含漏洞

No description provided by source...

CVE-2014-2689

Cross-site scripting XSS vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to installer/index.php...

CVE-2014-2689: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Offiria 2.1.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to installer/index.php...

CVE-2014-2933: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname...

CVE-2014-2936: Improper Control of Generation of Code

The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via 1 the maindirhotfolder parameter to dirmng/index.php, or an unspecified parameter to 2 PPD/index.php, 3 dirmng/docmd.php, or 4 dirmng/param.php...

PT-2014-4872

Name of the Vulnerable Software and Affected Versions Offiria versions 2.1.0 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to "installer/index.php". Recommendations For Offiria versions 2.1.0 and earlier, ...

PT-2014-4966

Name of the Vulnerable Software and Affected Versions Caldera version 9.20 Description The issue allows remote attackers to conduct variable-injection attacks in the global scope. This can be achieved via the maindir hotfolder parameter to "dirmng/index.php", or an unspecified parameter to...

PT-2014-4963

Name of the Vulnerable Software and Affected Versions Caldera version 9.20 Description A directory traversal issue exists, allowing remote attackers to access arbitrary directories by providing a crafted pathname in dirmng/index.php. Recommendations For Caldera version 9.20, update the...

BVS Site 4.0.1 / 5.2.1 Cross Site Scripting

Persistent Cross Site Scripting on BVS Site + Date: 02/05/2014 + Risk: HIGH + Author: Felipe Andrian Peixoto + Vendor Homepage: http://trac.reddes.bvsalud.org/projects/bvs-site/wiki/Downloads + Contact: [email protected] + Tested on: Windows 7 and Linux + Vulnerable File: index.php + Dork...

Adem 0.5.1 - Local File Inclusion Vulnerability

Exploit for php platform in category web applications ----------exploit Debut Local File Include Vulnerability ----------Script Info Author : JIKO ----------Script Info Site : https://github.com/4FSB/Adem && http://adem.faares.com/demo Version : 0.5.1 Download :...

Vtiger 6.0 /index.php 命令执行漏洞

No description provided by source...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the 1 module or 2 message parameter to index.php...

Adem 0.5.1 - Local File Inclusion

Adem 0.5.1 - Local File Inclusion ----------exploit Debut Local File Include Vulnerability ----------Script Info Author : JIKO ----------Script Info Site : https://github.com/4FSB/Adem && http://adem.faares.com/demo Version : 0.5.1 Download : https://codeload.github.com/4FSB/Adem/zip/master...

GeoCore MAX DB Ver. 7.3.3 - Blind SQL Injection

GeoCore MAX DB Ver. 7.3.3 - Blind SQL Injection Exploit Title: GeoCore MAX DB Ver. 7.3.3 - Time-Based Blind Injection Official site: http://geodesicsolutions.com Risk Level: High Vendor : http://geodesicsolutions.com Exploit Author: Esac Homepage author : www.iss4m.ma Last Checked: 25/04/2014...

CVE-2014-2715: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the 1 module or 2 message parameter to index.php...

PT-2014-4880

Name of the Vulnerable Software and Affected Versions VideoWhisper Webcam plugins for Drupal versions 7.x Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur...

Adem 0.5.1 Local File Inclusion

----------exploit Debut Local File Include Vulnerability ----------Script Info Author : JIKO ----------Script Info Site : https://github.com/4FSB/Adem && http://adem.faares.com/demo Version : 0.5.1 Download : https://codeload.github.com/4FSB/Adem/zip/master ----------exploit Info Exploit :...

SNEHA IT Soluctions's LFI Vulnerabilities

Exploit for windows platform in category web applications --------------------index.php-------------------- $page = $GET'page'; if$page!="" $p= $page; else echo "window.location = 'index.php';"; include SOURCES . $p; --------------------index.php-------------------- So you can include a fil by...

CVE-2014-2736: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...