2616 matches found
CVE-2011-3728
Dolphin 7.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xmlrpc/BxDolXMLRPCProfileView.php and certain other files...
CVE-2011-3744
HTML Purifier 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/PHPT/Reporter/SimpleTest.php and certain other files...
CVE-2011-3720
conceptcms 5.3.1, 5.3.3, and possibly other versions allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by syslibs/umlib/umauthserver.inc.php and certain other files...
CVE-2011-3701
CVE-2011-3701 affects AlegroCart 1.2.3. The issue allows remote attackers to obtain sensitive information by requesting a PHP file directly, causing an error message that reveals the installation path (demonstrated by common.php and related files). The documents do not provide remediation steps o...
CVE-2011-3734
Energine 2.3.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by core/framework/SimpleBuilder.class.php and certain other files...
CVE-2011-3754
Mambo 4.6.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/sef.php and certain other files...
CVE-2011-3741
CVE-2011-3741 affects Ganglia 3.1.7 and allows remote attackers to disclose sensitive information by requesting certain .php files (e.g., host_view.php), causing error messages that reveal the installation path. The vulnerability is a file-path disclosure via direct access to PHP scripts. The pro...
CVE-2011-3722
Coppermine Photo Gallery CPG 1.5.12 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by include/inspekt.php and certain other files...
CVE-2011-3720
ConceptCMS 5.3.1 and 5.3.3 (and possibly other versions) are affected by an information-disclosure vulnerability: remote attackers can obtain sensitive info via a direct request to a .php file, with an error message revealing the installation path (e.g., sys_libs/umlib/um_authserver.inc.php). Roo...
EIN-SOF Solutions Blind SQL Injection
========================================================================= EIN-SOF Solutions BLIND SQL-i Vulnerability ========================================================================== +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= +=+=+= +=+=+= +=+=+= /\ |...
WordPress TimThumb Plugin - Remote Code Execution
Exploit for php platform in category web applications Exploit Title: WordPress TimThumb Plugin - Remote Code Execution Google Dork: inurl:timthumb ext:php -site:googlecode.com -site:google.com Date: 3rd August 2011 Author: MaXe Software Link:...
CVE-2011-2745
uploadhandler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a writepost action to the...
Amoy Royal Taobao guest security vulnerabilities and fixes-vulnerability warning-the black bar safety net
Official website: http://www.taodisoft.com 1, demo Station background turned out to have a place to upload pictures, does not prohibit the upload. 2, the upload image simple filtration, easy to break, Upload a php file, and can be executed. 3, the servervpsconfiguration severe lower, get a webshe...
Leading Edge Technology Solutions SQL Injection
========================================================================= Leading Edge Technology Solutions L.E.T.S SQL-i Vulnerability ========================================================================== +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= +=+=+=...
Widespread LizaMoon Web Attacks Push Rogue Antivirus
Security firms are warning about a fast-spreading Web based attack that has been linked to the installation of rogue anti virus products. More than 300,000 Web sites have been compromised in a campaign dubbed “LizaMoon,” and are now serving up malicious links to rogue antivirus products, accordin...
Small Pirate <= 2.3 (avatar) Remote PHP File Execute PoC
Exploit for php platform in category web applications Exploit Title: Small Pirate Content of pwned.txt /home146/sub011/sc78626-TZRV/xxxxxxxxx.org/poc.php VICTIM: 207.182.149.243 info: Mozilla/5.0 X11; U; Linux i686; es-AR; rv:1.9.2.13 Gecko/20101206 Ubuntu/10.04 lucid Firefox/3.6.13 language:...
WordPress Plugin User Photo Component - Arbitrary File Upload
WordPress Plugin User Photo Component - Arbitrary File Upload Exploit Title: WordPress User Photo Component Remote File Upload Vulnerability Google Dork: inurl:"/wp-content/uploads/userphoto/" Date: 17/FEB/2011 Author: ADVtools Software Link: http://wordpress.org/extend/plugins/user-photo/ Versio...
Social Engine 4.x (Music Plugin) Arbitrary File Upload Vulnerability
Exploit Title: Social Engine 4.x Music Plugin Arbitrary File Upload Google Dork: inurl:"user/auth/forgot" Date: 22/12/2010 Author: MyDoom Moroccan Hacker Contact: [email protected] Software Link: http://http://www.socialengine.net Version: Social Engine 4.x should work on previous versions but...
Social Engine 4.x (Music Plugin) Arbitrary File Upload Vulnerability
Exploit for php platform in category web applications Exploit Title: Social Engine 4.x Music Plugin Arbitrary File Upload Google Dork: inurl:"user/auth/forgot" Date: 22/12/2010 Author: MyDoom Moroccan Hacker Contact: email protected Software Link: http://http://www.socialengine.net Version: Socia...
Multiple vulnerabilities in TYPO3 Core
It has been discovered that TYPO3 Core is vulnerable to Arbitrary Code Execution, Path Traversal, Cross-Site Scripting XSS, SQL injection and Information Disclosure. Component Type: TYPO3 Core Affected Versions: 4.2.15 and below, 4.3.8 and below, 4.4.4 and below Vulnerability Types: Arbitrary Cod...