NationBuilder - Multiple Persistent Cross-Site Scripting Vulnerabilities

Exploit for multiple platform in category web applications 1 Stored XSS in 'signupnote' POST parameter ---------------------------------------------- PoC: input type="hidden"...

Hippo CMS 10.1 Stored Cross Site Scripting

" / " / input type="...

WordPress Users Ultra 1.5.50 SQL Injection

Exploit Title: WordPress Users Ultra Plugin Blind SQL injection Discovery Date: 2015/10/19 Public Disclosure Date: 2015/12/01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://usersultra.com Software Link: https://wordpress.org/plugins/users-ultra/...

R-Scripts VRS 7R Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

PHP Vacation Rental Script version 7R suffers from cross site request forgery and cross site scripting vulnerabilities. R-Scripts VRS 7R Multiple Stored XSS And CSRF Vulnerabilities Vendor: R-Scripts Product web page: http://www.r-scripts.com Affected version: 7R Summary: PHP Vacation Rental Scri...

Mail.ru: [account.my.com] Reflected XSS

Reflected XSS via POST parameters in account.my.com. account.my.com is not covered by bug bounty scope...

Mail.ru: [allods.my.com] Reflected XSS

Browser-specific reflected XSS via POST parameters in allods.my.com. allods.my.com is not covered by bug bounty scope...

Mail.ru: [support.my.com] Reflected XSS

Reflected XSS via POST parameters in support.my.com. support.my.com is not covered by bug bounty scope...

Mail.ru: [evo.my.com] Reflected XSS

Browser-specific reflected XSS via POST parameters in evo.my.com. evo.my.com is not covered by bug bounty scope...

Mail.ru: [evo2.my.com] Reflected XSS

Browser-specific reflected XSS via POST parameters in evo2.my.com. evo2.my.com is not covered by bug bounty scope...

Joomla! Component Realtyna RPL 8.9.2 - Multiple SQL Injections

Realtyna RPL 8.9.2 Joomla Extension Multiple SQL Injection Vulnerabilities Vendor: Realtyna LLC Product web page: https://www.realtyna.com Affected version: 8.9.2 Summary: Realtyna CRM Client Relationship Management Add-on for RPL is a Real Estate CRM specially designed and developed based on...

WordPress Car Rental System SQL Injection Vulnerability

Exploit Title : Car Rental System Native WordPress Plugin SQL Injection vulnerability version3.1 Author : Manish Kishan Tanwar AKA error1046 Vendor Link : http://codecanyon.net/item/car-rental-system-native-wordpress-plugin/11758680 Affected Version: below version 3.1 Date : 12/07/2015 Love to :...

EZ SQL Reports <= 4.11.33 - Authenticated Arbitrary Code Execution

There are several calls to "passtthru" in the code, one of them is receiving the username, password, database name and host from the $POST arguments, so you can inject in every of this parameter the ";" character or others like "&&" or "||" to execute other distinct commands to "/usr/bin/mysql"...

A serious Wordpress 0 day exploit reverse engineering analysis-vulnerability warning-the black bar safety net

In just the past weekend,I got from my modsecurity logs found an interesting warning,logging a submit to my Wordpress site with one network request. Although this request did not succeed,but I decided to be an in-depth study,and trying to figure out this request information in the end is what,it...

WordPress Copy Or Move Comments 1.0.0 Cross Site Scripting Vulnerability

WordPress Copy or Move Comments plugin version 1.0.0 suffers from a cross site scripting vulnerability. Title: WordPress 'Copy or Move Comments' Plugin Version: 1.0.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: -...

WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities

WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion Date: 2015-06-23 Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" Exploit Author:...

WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities

Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion Date: 2015-06-23 Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Software Link:...

PT-2015-4852

Name of the Vulnerable Software and Affected Versions Cisco FireSIGHT System Software version 5.3.1.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via crafted GET or POST parameters. Recommendations For Cisco FireSIGHT System Software version 5.3.1.1,...

Balero CMS 0.7.2 - Multiple Blind SQL Injections

Balero CMS 0.7.2 - Multiple Blind SQL Injections Balero CMS v0.7.2 Multiple Blind SQL Injection Vulnerabilities Vendor: BaleroCMS Software Product web page: http://www.balerocms.com Affected version: 0.7.2 Summary: Balero CMS is an open source project that can help you manage the page of your...

Balero CMS 0.7.2 - Multiple Blind SQL Injections

Balero CMS v0.7.2 Multiple Blind SQL Injection Vulnerabilities Vendor: BaleroCMS Software Product web page: http://www.balerocms.com Affected version: 0.7.2 Summary: Balero CMS is an open source project that can help you manage the page of your company with just a few guided steps, minimizing the...

Balero CMS 0.7.2 SQL Injection

Balero CMS v0.7.2 Multiple Blind SQL Injection Vulnerabilities Vendor: BaleroCMS Software Product web page: http://www.balerocms.com Affected version: 0.7.2 Summary: Balero CMS is an open source project that can help you manage the page of your company with just a few guided steps, minimizing the...