75 matches found
ChemInv 1 Cross Site Scripting
Exploit Title: ChemInv - Authenticated Persistent Cross-Site Scripting Exploit Author: Bobby Cooke Date: 2020-04-29 Software Link: https://github.com/tmorrell/cheminv Software Info: "Cheminv is a web-based chemical inventory system. This responsive database provides an accessible way to organize...
PYSEC-2020-144
In Tortoise ORM before versions 0.15.23 and 0.16.6, various forms of SQL injection have been found for MySQL and when filtering or doing mass-updates on char/text fields. SQLite & PostgreSQL are only affected when filtering with contains, startswith, or endswith filters and their case-insensitive...
VehicleWorkshop 1.0 - (bookingid) SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: VehicleWorkshop 1.0 - 'bookingid' SQL Injection Exploit Author: Mehran Feizi Vendor HomagePage: https://github.com/spiritson/VehicleWorkshop Tested on: Windows Google Dork: N/A ========= Vulnerable Page: =========...
rtMedia for WordPress, BuddyPress & bbPress 3.7.39 - SQL Injection
When initialized, the rtMedia will include and instantiate certain classes if BuddyPress is installed. One of these classes is RTMediaActivityUpgrade, contained within the file ‘app/importers/RTMediaActivityUpgrade.php’. This class is instantiated in the file ‘admin/RTMediaAdmin.php,’ line 110, i...
Live Forms - Visual Form Builder 3.0.1 - Blind SQL Injection
The AJAX action ‘getreqlist’ is available to all logged in users. The parameter ‘ipp’ sent to this action is vulnerable to Blind MySQL Injection. This can be leveraged by detecting how long a query takes to return...
Cart66 Lite <= 1.5.3 - SQL Injection
The QSA named ‘q’ for the ‘promotionProductSearch’ AJAX call is not being sanitized, which allows for MySQL injection utilizing a UNION. The user must be logged in for this to be applicable. The output is JSON encoded, however is a pure representation of the data returned from a MySQL query...
Scripts Genie Domain Trader (catalog.php, id param) - SQL Injection Vulnerability
No description provided by source. / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Domain Trader Script, MySQL Injection Vulnerabilities Software Page:...
Scripts Genie Games Site Script (index.php, id param) - SQL Injection Vulnerability
No description provided by source. / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Games Site Script, MySQL Injection Vulnerabilities Software Page: http://scriptsgenie.com/index.php?do=catalog&c=scripts&i=gamessitescript...
RTTucson Quotations Database - Multiple Vulnerabilities
No description provided by source. / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // RTTucson Quotations Database Script, Multiple Vulnerabilities Software Page: http://www.rttucson.com/index.html Script Demo:...
Scripts Genie Gallery Personals (gallery.php, L param) - SQL Injection Vulnerability
No description provided by source. / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Gallery Personals Script SQL Injection Vulnerabilities Software Page: http://scriptsgenie.com/ Product Page:...
Scripts Genie Top Sites (out.php, id param) - SQL Injection Vulnerability
No description provided by source. / / / \ / / / / / / / / / / / // / / / / / / // / // / / / / | // / / / / / // / / / // / /,// /////,// ///// , / // Top Sites Script, SQL Injection Vulnerabilities Software Page: http://scriptsgenie.com/index.php?do=catalog&c=scripts&i=topsitescript...
Open Real Estate CMS 1.5.1 - Multiple Vulnerabilities
No description provided by source. Exploit Title: Open Real Estate CMS - Multiple vilnerabilities Date: 2013 9 August Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: http://monoray.net/products/6-open-real-estat...
Monkey CMS - Multiple Vulnerabilities
No description provided by source. Exploit Title: Monkey CMS - Multiple Vulnerabilities Date: 2013 17 June Exploit Author: Yashar shahinzadeh & Mormoroth Vendor Homepage: http://www.monkeycms.com/ Tested on: Linux & Windows, PHP 5.3.10 Affected Version : All versions Contacts:...
CoSoSys Endpoint Protector 4 SQL Injection / Backdoor
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: CoSoSys Endpoint Protector 4 vulnerable version: all - except issue 1 fixed version: none ...
PHP-Nuke Web Links SQL Injection
PHP-Nuke moduleWeb Links - Sql Injection Vulnerabilty =================================================================== .:. Author : AtT4CKxT3rR0r1ST .:. Contact : [email protected] , [email protected] .:. Home : http://www.iphobos.com/blog/ .:. Script : https://www.phpnuke.org/ .:. Dork :...
Cory Support "q" SQL注入漏洞
Cory Support是一款PHP应用。 由于通过"q" GET参数传递到loadsolve.php的输入在被用于SQL查询前未能正确过滤，攻击者可以利用漏洞通过注入任意SQL代码操纵SQL查询。 0 Cory Support 1.0 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://coryapp.com/page.php?id=1 // GET MySQL Injection with "q" Parameter in /loadsolve.php 1 : ?php 2 :...
Open Real Estate CMS 1.5.1 - Multiple Vulnerabilities
Open Real Estate CMS 1.5.1 - Multiple Vulnerabilities Exploit Title: Open Real Estate CMS - Multiple vilnerabilities Date: 2013 9 August Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage:...
Open Real Estate CMS 1.5.1 - Multiple Vulnerabilities
Exploit Title: Open Real Estate CMS - Multiple vilnerabilities Date: 2013 9 August Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: http://monoray.net/products/6-open-real-estate Tested on: Linux & Windows, PHP...
Machform Form Maker 2 XSS / Shell Upload / SQL Injection
Exploit Title: Machform form maker - Multiple Vulnerabilities Date: 2013 17 June Exploit Author: Yashar shahinzadeh Credit goes for: ha.cker.ir Vendor Homepage: http://www.appnitro.com Tested on: Linux & Windows, PHP 5.2.9 Affected Version : 2 Special thanks to: Mormoroth Dork1: "Powered by...
Machform Form Maker 2 - Multiple Vulnerabilities
Exploit for php platform in category web applications Summary: ======== 1. Arbitrary file upload 2. MySQL Injection Error based and XSS 1. Arbitrary file upload: ========================= ... ... if!empty$uploadedfiles foreach $uploadedfiles as $elementname ifempty$formreview //move file and chec...