WordPress Plugin wp-autoyoutube - Blind SQL Injection

WordPress Plugin wp-autoyoutube - Blind SQL Injection Exploit Title: WordPress wp-autoyoutube plugin Blind SQL Injection Vulnerability Date: 2012-11-01 Author: longrifle0x software: Wordpress Download:http://wordpress.org/extend/plugins/wp-autoyoutube/ Tools: SQLMAP DESCRIPTION Discovered a...

Pragyan CMS 3.0 Remote File Disclosure

Title Pragyan CMS v 3.0 = Remote File Disclosure Author Or4nG.M4n Download http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2 vuln download.lib.php line 16 vuln index.php line 234 $GET'fileget' exploit...

Pragyan CMS 3.0 - Remote File Disclosure

Title Pragyan CMS v 3.0 = Remote File Disclosure Author Or4nG.M4n Download http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2 vuln download.lib.php line 16 vuln index.php line 234 $GET'fileget' exploit...

Pragyan CMS v 3.0 Remote File Disclosure

Exploit for php platform in category web applications Title Pragyan CMS v 3.0 = Remote File Disclosure Author Or4nG.M4n Download http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2 vuln download.lib.php line 16 vuln index.php line 234 $GET'fileget' exploit...

Joomla Simple File Upload Module Remote Code Execution Vulnerability

This host is running Joomla Simple File Upload Module and is prone to remote code execution vulnerability. OpenVAS Vulnerability Test $Id: gbjoomlasimplefileuploadcodeexecvuln.nasl 5841 2017-04-03 12:46:41Z cfi $ Joomla Simple File Upload Module Remote Code Execution Vulnerability Authors: Madhur...

Cross site scripting

Cross-site scripting XSS vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the ddb parameter...

CVE-2011-5019

Cross-site scripting XSS vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the ddb parameter...

CVE-2011-5019

Cross-site scripting XSS vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the ddb parameter...

CVE-2011-5019: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the ddb parameter...

SourceForge Local File Inclusion

Exploit Title: SourceForge.Net LGames LFI Vulnerability / 0DAY Date: 31/12/2011 - 17.38 Author: 3spi0n Platform: Php Vulnerable File - " index.php?project= " $ Vulnerability ; Lgames.sourceforge.net/index.php?project=../../../.././../etc/passwd%00LFI Vulnerability Dar bi Koridor Benimki, Kendimi...

PT-2012-2026

Name of the Vulnerable Software and Affected Versions Textpattern CMS version 4.4.1 Description A cross-site scripting XSS issue exists due to incomplete installation, allowing remote attackers to inject arbitrary web script or HTML via the ddb parameter in the setup/index.php file. Recommendatio...

PHPCMS V9 index.php 跨站脚本漏洞

漏洞文件：phpcms/modules/message/templates/index.php 漏洞代码： 176行: $replyinfos= $this-messagedb-listinfo$where,$order = 'messageid ASC',$page, $pages = '10'; 191行: $replyinfos= $this-messagedb-listinfo$where,$order = 'messageid ASC',$page, $pages = '10'; 漏洞代码： 将176行和191行都替换为成: $replyinfos...

PHPCMS 9 index.php 本地文件包含漏洞

phpcms/modules/search/index.php 代码如下： public function publicgetsuggestkeyword $url = $GET'url'.'&q='.$GET'q'; $res = @filegetcontents$url; ifCHARSET != 'gbk' $res = iconv'gbk', CHARSET, $res; echo $res;...

Sql injection

SQL injection vulnerability in hitCode hitAppoint 4.5.17 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2011-5038

SQL injection vulnerability in hitCode hitAppoint 4.5.17 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2011-5041

Pulse Pro CMS 1.7.2 contains multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter in a blocks action and (2) post_id parameter in an edit-post action to index.php. The available connected documents corrobora...

CVE-2011-5041

Multiple cross-site scripting XSS vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 d parameter in a blocks action and 2 postid parameter in an edit-post action to index.php...

CVE-2011-5038: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in hitCode hitAppoint 4.5.17 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2011-5041: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 d parameter in a blocks action and 2 postid parameter in an edit-post action to index.php...

PT-2011-5185

Name of the Vulnerable Software and Affected Versions hitAppoint versions 4.5.17 and earlier Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the username parameter in the "index.php" endpoint. Recommendations For versions...