WordPress Plugin WP-Client 3.8.7 - Persistent Cross-Site Scripting

WordPress Plugin WP-Client 3.8.7 - Persistent Cross-Site Scripting Application: WP-Client Version: 3.8.7 Author: Pier-Luc Maltais from COSIG Twitter: @COSIG 1 Introduction 2 Report Timeline 3 Technical details 4 POC =============== 1 Introduction =============== One plugin configures multiple are...

WordPress WP-Ecommerce-Shop-Styling 2.5 File Download Vulnerability

WordPress WP-Ecommerce-Shop-Styling plugin version 2.5 suffers from an arbitrary file download vulnerability. Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-05 Download Site:...

WordPress Plugin WP E-Commerce Shop Styling 2.5 - Arbitrary File Download

Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-05 Download Site: https://wordpress.org/plugins/wp-ecommerce-shop-styling Vendor: https://profiles.wordpress.org/haet/ Vendor Notified: 2015-07-05, fixed...

WordPress WP-Ecommerce-Shop-Styling 2.5 File Download

Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-05 Download Site: https://wordpress.org/plugins/wp-ecommerce-shop-styling Vendor: https://profiles.wordpress.org/haet/ Vendor Notified: 2015-07-05, fixed...

CVE-2015-4382

Multiple cross-site request forgery CSRF vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 create, 2 delete, or 3 alter invoices via unspecified vectors...

Invoice - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-085

Invoice module allows you to create invoices in Drupal. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. Additionally, some URLs were not protected against CSRF. A malicious user can cause another user to create,...

CactuShop - User Invoices Persistent XSS Vulnerability

No description provided by source. User Invoices Persistent XSS Vulnerability in CactuShop 1. Advisory Information Title: User Invoices Persistent XSS Vulnerability in CactuShop Advisory Id: CORE-2010-0406 Advisory URL: http://www.coresecurity.com/content/cactushop-xss-persistent-vulnerability Da...

Allpc 2.5 osCommerce SQL/XSS Multiple Vulnerabilities

No description provided by source. +Title Allpc 2.5 osCommerce SQL-i/XSS Multiple Vulnerabilities +Author RoAdKiLlEr +Contact RoAdKiLlEratKhg-CrewdotWs +Tested on Win Xp Sp 2/3 --------------------------------------------------------------------------- Founded by RoAdKiLlEr Team: Albanian Hacking...

PicoPublisher 2.0 - Remote SQL Injection

No description provided by source. Exploit Title : PicoPublisher v2.0 Remote SQL injection Date : 29/03/2012 Author : ZeTH Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com Vendor : Pico Software Site : http://pico.no/ Version : 2.0 Price : $29,00 Dork : intext:Drives med...

AWBS 2.9.2 (cart.php) Blind SQL Injection Vulnerability

No description provided by source. AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom Vendor..:...

Microsoft charges FBI for your Information; Syrian Electronic Army leaks Invoices

Till now we all were aware about the truth that tech companies gave legal access to user data on the government's request, but we were unaware that well known tech companies also charge the government for providing data. Syrian Electronic Army SEA, the pro-hacker group, who had compromised...

Threat Outbreak Alert: Fake Payment Invoice Email Messages on October 14, 2013

Medium Alert ID: 31246 First Published: 2013 October 14 19:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment invoice for the recipient. The text in the email message attempts to convince the recipient to open...

Simple Invoices Multiple XSS Vulnerabilities

Simple Invoices is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CitrusDB 2.4.1 - LFI/SQLi Vulnerability

CitrusDB 2.4.1 - LFI/SQLi Vulnerability Author: Michal wacky Blaszczak WWW: blaszczakm.blogspot.com CitrusDB is an open source customer service and billing database. It can be used by customer service personnel to provide sales and support to customers, and by billing staff to bill customers for...

PicoPublisher 2.0 SQL Injection

Exploit Title : PicoPublisher v2.0 Remote SQL injection Date : 29/03/2012 Author : ZeTH Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com Vendor : Pico Software Site : http://pico.no/ Version : 2.0 Price : $29,00 Demo : http://picopublisher.com/demo/ Dork : intext:"Drives med...

PicoPublisher 2.0 - SQL Injection

PicoPublisher 2.0 - SQL Injection Exploit Title : PicoPublisher v2.0 Remote SQL injection Date : 29/03/2012 Author : ZeTH Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com Vendor : Pico Software Site : http://pico.no/ Version : 2.0 Price : $29,00 Dork : intext:"Drives med...

PicoPublisher v2.0 Remote SQL injection

Exploit for php platform in category web applications Exploit Title : PicoPublisher v2.0 Remote SQL injection Date : 29/03/2012 Author : ZeTH Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com Vendor : Pico Software Site : http://pico.no/ Version : 2.0 Price : $29,00 Dork :...

GAzie <= 5.20 Cross Site Request Forgery

Exploit for php platform in category web applications ======================================== GAzie Date: 5/02/2012 Site: http://www.giudinvx.altervista.org/ -------------------------------------------------------- @Application Info: Multicompany finance application written in PHP using a MySql...

AWBS 2.9.2 (cart.php) Blind SQL Injection Vulnerability

Exploit for php platform in category web applications AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom...

AWBS 2.9.2 - 'cart.php' Blind SQL Injection

AWBS 2.9.2 Blind SQL Injection 0day ============================================================================================= Dork....: inurl:/cart?ca=addother&oid= Date....: 01-16-2011 Author..: ShivX Contact.: shivanxatgmaildotcom Vendor..: http://www.awbs.com Link....:...