Trusted-Directory Bypass via Path Traversal

if you enable secrity .$trusteddir is an array of all directories that are considered trusted. Trusted directories are where you keep php scripts that are executed directly from the templates . the attackers can use ../ to bypass the dir ,if they can editing the templates, they read any file they...

Match Clone Script 1.0.4 Cross Site Scripting

Exploit Title: Match Clone Script 1.0.4 - Cross-Site Scripting Date: 23.02.2018 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/match-clone/ Category: Web Application Exploit Author: ManhNho Version: 1.0.4 Tested on: Window 10 / Kali Linux CV...

Match Clone Script 1.0.4 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Match Clone Script 1.0.4 - Cross-Site Scripting Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/match-clone/ Category: Web Application Exploit Author: ManhNho Version: 1.0.4...

Match Clone Script 1.0.4 - Cross-Site Scripting

Match Clone Script 1.0.4 - Cross-Site Scripting Exploit Title: Match Clone Script 1.0.4 - Cross-Site Scripting Date: 23.02.2018 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/match-clone/ Category: Web Application Exploit Author: ManhNho...

Match Clone Script 1.0.4 - Cross-Site Scripting

Exploit Title: Match Clone Script 1.0.4 - Cross-Site Scripting Date: 23.02.2018 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/match-clone/ Category: Web Application Exploit Author: ManhNho Version: 1.0.4 Tested on: Window 10 / Kali Linux CV...

CVE-2018-6934

CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3...

Cross site scripting

Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature...

Input validation

PHP Scripts Mall Website Seller Script 2.0.3 uses the client side to enforce validation of an e-mail address, which allows remote attackers to modify a registered e-mail address by removing the validation code...

Cross site request forgery (csrf)

CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3...

CVE-2018-6904

PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action...

CVE-2018-6900

PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page...

CVE-2018-6934

CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3...

CVE-2018-6870

Reflected XSS exists in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature...

CVE-2018-6900

PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page...

CVE-2018-6902

PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action...

CVE-2018-6904

PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action...

CVE-2018-6935

PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to liststudent.php...

CVE-2018-6870

The CVE-2018-6870 entry describes a Reflected XSS in PHP Scripts Mall Website Seller Script 2.0.3 via the Listings Search feature. Affected software is PHP Scripts Mall Website Seller Script 2.0.3; root cause identified as reflected XSS through the Listings Search parameter. No exploit details or...

CVE-2018-6879

The CVE-2018-6879 entry concerns PHP Scripts Mall Website Seller Script 2.0.3 where client-side validation is used to enforce email format. The vulnerability arises because the validation can be bypassed by removing the client-side validation code, enabling a remote attacker to modify a registere...

CVE-2018-6900

The CVE-2018-6900 entry concerns PHP Scripts Mall Website Broker Script 3.0.6, with a reflected/stored XSS via the Last Name field on the My Profile page. The publicly documented content across sources confirms the vulnerable component (the broker script), the input vector (Last Name on My Profil...