WordPress Newsletter Pro 2.5.3.3 Open Redirect

^^^^^^^^^^^ ^ Exploit Title : Wordpress Newsletter Pro Plugin Open Redirect ^ Exploit Author : Ashiyane Digital Security Team ^ Vendor Homepage: http://www.thenewsletterplugin.com/downloads ^ Google Dork : inurl:newsletter-pro/do.php ^ Date : 06 Feb. 2016 ^ Tested On : Win 10 | CyberFox Browser &...

PHP File Manager 0.9.8 Authentication Bypass / Code Execution

PHP File Manager 0.9.8 http://phpfm.sourceforge.net/ is vulnerable to authentication bypass due to insecure implementation of register globals emulation. An attacker is able to override the blockKeys array and thus build a valid session and access all the protected functionality including executi...

WordPress Tubepress 2 Cross Site Scripting

^^^^^^^^^^^ ^ Exploit Title : Wordpress Tubepress Plugin v 2 Cross Site Scripting ^ Exploit Author : Ashiyane Digital Security Team ^ Vendor Homepage : https://wordpress.org/plugins/tubepress/ ^ Date: 13 Jan 2016 ^ Tested On : Win 10 | CyberFox Browser & Kali Linux | IceWeasel ^ ^^^^^^^^^^^ ^...

Zen Cart 1.5.4 - Local File Inclusion

Zen Cart 1.5.4 - Local File Inclusion Advisory ID: HTB23282 Product: Zen Cart Vendor: Zen Ventures, LLC Vulnerable Versions: 1.5.4 Tested Version: 1.5.4 Advisory Publication: November 25, 2015 without technical details Vendor Notification: November 25, 2015 Vendor Patch: November 26, 2015 Public...

Bitrix bitrix.mpbuilder Module 1.0.10 - Local File Inclusion

Bitrix bitrix.mpbuilder Module 1.0.10 - Local File Inclusion Advisory ID: HTB23281 Product: bitrix.mpbuilder Bitrix module Vendor: www.1c-bitrix.ru Vulnerable Versions: 1.0.10 and probably prior Tested Version: 1.0.10 Advisory Publication: November 18, 2015 without technical details Vendor...

Bitrix bitrix.mpbuilder Module 1.0.10 - Local File Inclusion

Advisory ID: HTB23281 Product: bitrix.mpbuilder Bitrix module Vendor: www.1c-bitrix.ru Vulnerable Versions: 1.0.10 and probably prior Tested Version: 1.0.10 Advisory Publication: November 18, 2015 without technical details Vendor Notification: November 18, 2015 Vendor Patch: November 25, 2015...

bitrix.scan Bitrix 1.0.3 Path Traversal Vulnerability

bitrix.mpbuilder Bitrix module version 1.0.10 suffers from a local file inclusion vulnerability. Product: bitrix.mpbuilder Bitrix module Vendor: www.1c-bitrix.ru Vulnerable Versions: 1.0.10 and probably prior Tested Version: 1.0.10 Advisory Publication: November 18, 2015 without technical details...

bitrix.scan Bitrix 1.0.3 Path Traversal Vulnerability

bitrix.scan Bitrix module version 1.0.3 suffers from a path traversal vulnerability. Product: bitrix.xscan Bitrix module Vendor: Bitrix Vulnerable Versions: 1.0.3 and probably prior Tested Version: 1.0.3 Advisory Publication: November 18, 2015 without technical details Vendor Notification: Novemb...

appRain 4.0.3 Path Traversal

Security Advisory - Curesec Research Team 1. Introduction Affected Product: appRain 4.0.3 Fixed in: not fixed Fixed Version Link: n/a Vendor Website: [email protected] Vulnerability Type: Path Traversal Remote Exploitable: Yes Reported to vendor: 10/02/2015 Disclosed to public: 12/02/2015 Release...

SimpleBB 4.2 Shell Upload

SimpleBB 4.2 + All ver upload Vulnerability ========================================== Author : indoushka Vondor : http://themeforest.net/item/simple-bulletin-board/58838?ref=themac Dork : SBB V4.2 ========================= 1 register in forum 2 Creat a new topic 3 Attachment a php file to downol...

WordPress Plugin Gwolle Guestbook 1.5.3 - Remote File Inclusion

Advisory ID: HTB23275 Product: Gwolle Guestbook WordPress Plugin Vendor: Marcel Pol Vulnerable Versions: 1.5.3 and probably prior Tested Version: 1.5.3 Advisory Publication: October 14, 2015 without technical details Vendor Notification: October 14, 2015 Vendor Patch: October 16, 2015 Public...

WordPress Gwolle Guestbook 1.5.3 Remote File Inclusion

Advisory ID: HTB23275 Product: Gwolle Guestbook WordPress Plugin Vendor: Marcel Pol Vulnerable Versions: 1.5.3 and probably prior Tested Version: 1.5.3 Advisory Publication: October 14, 2015 without technical details Vendor Notification: October 14, 2015 Vendor Patch: October 16, 2015 Public...

Zenphoto 1.4.10 Local File Inclusion

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ZEN-PHOTO-1.4.10-LFI.txt Vendor: ==================== www.zenphoto.org Product: =================== Zenphoto 1.4.10 Vulnerability Type: ======================== Local File Inclusion CVE...

ZenPhoto 1.4.10 - Local File Inclusion

ZenPhoto 1.4.10 - Local File Inclusion + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ZEN-PHOTO-1.4.10-LFI.txt Vendor: ==================== www.zenphoto.org Product: =================== Zenphoto 1.4.10 Vulnerability Type:...

ZenPhoto 1.4.10 - Local File Inclusion

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ZEN-PHOTO-1.4.10-LFI.txt Vendor: ==================== www.zenphoto.org Product: =================== Zenphoto 1.4.10 Vulnerability Type: ======================== Local File Inclusion CVE...

Centreon 2.6.x < 2.6.2 File Upload RCE

According to its version number, the Centreon application hosted on the remote web server is 2.6.x prior to 2.6.2. It is, therefore, affected by a remote code execution vulnerability due to improper sanitization of user-uploaded files via the main.php script. An authenticated, remote attacker can...

DEBIAN-CVE-2015-5734

Cross-site scripting XSS vulnerability in the legacy theme preview implementation in wp-includes/theme.php in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via a crafted string...

Wordpress AlertWire 1.1.1 Plugin - Full Path Disclosure Vulnerability

Exploit for php platform in category web applications Title : Wordpress Plugin AlertWire 1.1.1 - Full Path Disclosure Vulnerability Date : 17/12/2014 Author : ZwX Download Link : https://wordpress.org/plugins/alertwire/ Vendor : http://www.alertwire.com/ Tested : Windows 7...

Vtiger CRM 6.3.0 Authenticated Remote Code Execution

Exploit for php platform in category web applications Exploit Title: Vtiger CRM = 6.3.0 Authenticated Remote Code Execution Date: 2015-09-28 Exploit Author: Benjamin Daniel Mussler Vendor Homepage: https://www.vtiger.com Software Link: https://www.vtiger.com/open-source-downloads/ Version: 6.3.0...

台州市极速网络CMS /data/log/passlog.php 任意代码执行漏洞

先看根目录当中的login.php? $ISLOGIN = true; require "./includes/headinc.php"; registershutdownfunction'unionend'; if$action == 'logout' $unionuser = $unionpass = $gid = ''; //clearcookies; //$sessarr = array; $SESSIONsessarr = $sessarr = ''; sessionunregister'sessarr'; echo "meta http-equiv="refresh"...