n2cms 2.2.1 Path Disclosure

Affected software: n2cms Type of vulnerability:full path disclosure URL:n2cms.com Discovered by: provensec Website: provensec.com version: 2.2.1 Proof of concept http://demo.n2cms.com/N2/Files/FileSystem/File.aspx?selected=%2fupload%2f%22%3E%3Cimg%20src=d%20onerror=confirm1;%3E1.php%2f manipulati...

WordPress eShop 6.3.11 Code Execution Exploit

High-Tech Bridge Security Research Lab discovered a security vulnerability in the eShop WordPress Plugin, which can be exploited by remote attackers to overwrite arbitrary PHP variables within the context of the vulnerable application. The vulnerability exists due to insufficient validation of...

Nodes Studio CMS XSS / Path Disclosure / SQL Injection

Hello list! There are SQL Injection, Cross-Site Scripting and Full Path Disclosure vulnerabilities in Nodes Studio CMS. This is Russian commercial CMS, which I found at one site of Russian terrorists and propagandists. ------------------------- Affected vendors: ------------------------- Nodes...

Arbitrary Variable Overwrite in eShop WordPress Plugin

High-Tech Bridge Security Research Lab discovered security vulnerability in eShop WordPress Plugin, which can be exploited by remote attacker to overwrite arbitrary PHP variables within the context of the vulnerable application. The vulnerability exists due to insufficient validation of...

Fusion Engage 1.0.5 - Local File Disclosure

The fusion-engage WordPress plugin was affected by a Local File Disclosure security vulnerability. curl --data "action=fegetsvhtml&video=../wp-config.php" "http://www.example.com/wp-admin/admin-ajax.php";...

724CMS 5.01 / 4.59 / 4.01 / 3.01 Information Leakage

724CMS 5.01 Multiple Information Leakage Security Vulnerabilities Exploit Title: 724CMS Multiple Information Leakage Security Vulnerabilities Vendor: 724CMS Product: 724CMS Vulnerable Versions: 3.01 4.01 4.59 5.01 Tested Version: 5.01 Advisory Publication: March 14, 2015 Latest Update: March 14,...

NetCat.ru Netcat Information Disclosure Vulnerability

NetCat.ru Netcat is a web content management system CMS from the Russian company NetCat.ru. A security vulnerability exists in NetCat.ru Netcat 5.01 and earlier versions, which stems from the netshop/post.php script failing to adequately filter the 'redirecturl' parameter. A remote attacker can...

CVE-2015-2209

DLGuard 4.5 allows remote attackers to obtain the installation path via the c parameter to index.php...

CVE-2015-2209

CVE-2015-2209 affects DLGuard 4.5. Affected component: index.php parameter handling. The vulnerability arises from insufficient input filtering, allowing remote attackers to disclose the installation path via the c parameter to index.php (information disclosure). Reported in several sources (NVD/...

NetCat CMS 5.01 / 3.12 Full Path Disclosure

NetCat CMS Full Path Disclosure Information Disclosure Security Vulnerabilities Exploit Title: NetCat CMS Full Path Disclosure Security Vulnerabilities Product: NetCat CMS Content Management System Vendor: NetCat Vulnerable Versions: 5.01 3.12 3.0 2.4 2.3 2.2 2.1 2.0 1.1 Tested Version: 5.01 3.12...

Googlemaps Plugin Path Disclosure Vulnerability in Joomla!

Joomla! is a content management system. Joomla! Googlemaps plugin is a plugin for inserting google maps for Joomla! A path disclosure vulnerability exists in Joomla! Googlemaps Plugin that allows attackers to obtain sensitive information...

PHP3 Physical Path Disclosure via POST Requests

The version of PHP3 running on the remote host will reveal the physical path of a given script when sent a HTTP POST request without a content-type header if it is incorrectly configured. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; i...

ownCloud Asset Pipeline Feature Remote Path Disclosure Vulnerability (oC-SA-2014-021)

ownCloud is prone to a path disclosure vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud";...

DLGuard 4.5 Path Disclosure

DLGuard Full Path Disclosure Information Leakage Security Vulnerabilities Exploit Title: DLGuard /index.php c parameter Full Path Disclosure Security Vulnerabilities Product: DLGuard Vendor: DLGuard Vulnerable Versions: v4.5 Tested Version: v4.5 Advisory Publication: Feb 18, 2015 Latest Update: F...

Mail.ru: Full Path Disclosure

Здравствуйте, Я обнаружил уязвимость на ling.go.mail.ru переходим по ссылке: http://ling.go.mail.ru/brat//c37hun внизу сайта видим error: /var/www/brat/server/src/../../data/c37hun.txt Unable to read text file...

NextGEN Gallery 1.9.11 - Full Path Disclosure

The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a Full Path Disclosure security vulnerability...

CVE-2014-100009

The Joomlaskin JS Multi Hotel aka JS MultiHotel and Js-Multi-Hotel plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to 1 functions.php, 2 myCalendar.php, 3 refreshDate.php, 4 showimage.php, 5 widget.php, 6 phpthumb/GdThumb.inc.php, or 7...

CVE-2014-100009

Affected software: WordPress plugin JS Multi Hotel (aka JS MultiHotel, Js-Multi-Hotel), version 2.2.1 and earlier. Vulnerability: path disclosure via direct requests to multiple PHP files (functions.php, myCalendar.php, refreshDate.php, show_image.php, widget.php, phpthumb/GdThumb.inc.php, phpthu...

WordPress Html5 Mp3 Player 'playlist.php' Path Disclosure Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

Tribal Tribiq CMS Path Disclosure Vulnerability

Tribal Tribiq CMS is a content management CMS system. A security vulnerability exists in the templatewrap/templatefoot.php, cmsjs/plugin.js.php, and cmsincludes/cmspluginapilink.inc.php scripts of Tribal Tribiq CMS version 5.2.7b and earlier. A remote attacker could exploit the vulnerability by...