Project Man 1.0 SQL Injection

Project Man Download: http://sourceforge.net/projects/projectman1/files/ PoC: Project Manpath/login.php Username: ' or '1=1 password: ' or '1=1...

Scripts Feed Business Directory - SQL Injection

Scripts Feed Business Directory - SQL Injection ============================================================================== Scripts Feed Business Directory SQL Injection Vulnerability ============================================================================== + My home http://hack-tech.com ...

Project Man 1.0 - Authentication Bypass

Project Man 1.0 - Authentication Bypass Project Man Download: http://sourceforge.net/projects/projectman1/files/ PoC: Project Manpath/login.php Username: ' or '1=1 password: ' or '1=1...

DeltaScripts PHP Links XSS Vulnerability

Exploit for unknown platform in category web applications ======================================== DeltaScripts PHP Links XSS Vulnerability ======================================== + Exploit Title: DeltaScripts PHP Links XSS Vulnerability + Date: January 09 2010 + Author: Crux mail:email protecte...

Killmonster <= 2.1 (Auth Bypass) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================ Killmonster Type Username Here: Type Password Here: authenticate.php $isadmin=$POST'isadmin'; $password=$POST'password'; $password=md5$password; $query = "select from kmadmins...

BoastMachine 3.1 - Arbitrary File Upload

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Exploit Title : boastMachine v3.1 Remote File Upload Vulnerability Author: alnjm33 Software Link: http://boastology.com/pages/dload.php?id=bmachine-3.1.zip Software...

al3jeb script - Remote Authentication Bypass

al3jeb script - Remote Authentication Bypass '/ -.- --------------------oOO------OOo------------------- | al3jeb script Remote Login Bypass Exploit | | works only with magicquotesgpc = off | ------------------------------------------------------ ! Discovered: cr4wl3r ! Date: 19.01.2010 ! Remote:...

DeltaScripts PHP Links 1.0 Cross Site Scripting

H A C K - T E C H E X P L O I T S - by Crux + Exploit Title: DeltaScripts PHP Links XSS Vulnerability + Date: January 09 2010 + Author: Crux mail:[email protected] + Software Link: http://www.deltascripts.com/phplinks/ + Version: 1.0 + Tested on: ALL OS + Dork: NO NO NO! Vulnerable File...

dedecms <=5.7 member-login.php 跨站脚本攻击漏洞

No description provided by source...

WordPress 1.2 wp-login.php响应拆分攻击漏洞

No description provided by source...

CVE-2009-4461: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FlatPress 0.909 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 contact.php, 2 login.php, and 3 search.php...

phpGroupWare多个输入验证漏洞

BUGTRAQ ID: 35761 CVE ID: CVE-2009-4414,CVE-2009-4415,CVE-2009-4416 phpGroupWare是一个用PHP编写的多用户的网络组件，为开发其他程序提供了一个API。 phpGroupWare的多个组件中存在输入验证错误，远程攻击者可以通过提交恶意请求泄露敏感信息、执行跨站脚本或SQL注入攻击。 1 没有正确地验证传送给csvfile参数的输入便在addressbook/csvimport.php中使用，这可能导致在受影响系统上读取任意文件的内容。 2...

CVE-2009-4416

Cross-site scripting XSS vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw" sequence...

CVE-2009-4414: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in phpgwapi /inc/class.authsql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the passwd parameter to login.php...

CVE-2009-4416: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter whose name begins with the "phpgw" sequence...

CVE-2009-4347: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in daloradius-users/login.php in daloRADIUS 0.9-8 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter...

CVE-2009-4237: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.8.5 allow remote attackers to inject arbitrary web script or HTML via 1 the req parameter to login.php, and allow remote authenticated users to inject arbitrary web script or HTML via 2 the key parameter to...

Pligg login.php return Parameter Arbitrary Site Redirect

The remote host is running Pligg, an open source content management system. The installed version of Pligg contains an open redirect, in the 'return' parameter of its 'login.php' script. This could be abused to launch a phishing attack to trick users into visiting malicious sites. Note that this...

Sql injection

SQL injection vulnerability in login.php in sample code in the XenServer Resource Kit in Citrix XenCenterWeb allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-3758

CVE-2009-3758 is a SQL injection in login.php of the XenServer Resource Kit / XenCenterWeb. The vulnerability allows remote attackers to execute arbitrary SQL commands via the username parameter, as described in NVD/NIST and mirrored in multiple sources. Public exploit coverage is indicated by a ...