Jaws 1.1.1 Cross Site Request Forgery

Affected software: Jaws cms Type of vulnerability:csrf URL:http://www.opensourcecms.com/scripts/details.php?scriptid=38&name=Jaws Discovered by: provensec Website: provensec.com version: Jaws 1.1.1 Proof of concept Jaws...

Pimcore CMS 3.0.5 Cross Site Request Forgery

Affected software: pimcore cms Type of vulnerability:csrf URL:pimcore.org Discovered by: provensec Website: provensec.com version: Version: 3.0.5 Build: 3468 Proof of concept no csrf token on add dashboard form...

Hippo CMS 7.9.7 Enterprise Edition CRLF Injection

Affected software: hippo cms Type of vulnerability:crlf URL:https://cms.demo.onehippo.com Discovered by: provensec Website: provensec.com version: CMS 7.9.7 Enterprise Edition Proof of concept payload : advanced%0d%0aContent-Length:%200%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0aContent-...

Interspire Email Marketer 6.1.5 Cross Site Scripting

Affected software: interspire email marketer Type of vulnerability:flash xss URL:http://emailmarketer.interspire-demo.com/ Discovered by: provensec Website: provensec.com version: Interspire Email Marketer 6.1.5 Proof of concept...

Qlik Open Redirect

Affected software: qlik Type of vulnerability:open redirect URL:qlik.com Discovered by: provensec Website: provensec.com version: n/a Proof of concept vulnerable param:returnurl https://login.qlik.com/login.aspx?status=lol&returnURL=domain example:...

phpList 3.0.10 Insecure Direct Object Reference

Affected software: phplist Type of vulnerability: insecure object reference URL:phplist.com Discovered by: Provensec Website: http://www.provensec.com version: phpList ltd. - v3.0.10 Proof of concept insecure object refrenced on page deltetation vuln param:delete example:...

CMS Builder 2.07 SQL Injection

Affected software: CMS Builder v2.07 Type of vulnerability: sql injection URL: http://demo2.interactivetools.com/cmsbuilder2/bottom.php Discovered by: Provensec Website: http://www.provensec.com versionv2.07 Proof of concept...

Uploadify 3.1 Cross Site Scripting

Affected software: Type of vulnerability: URL: http://www.uploadify.com/ Discovered by: Provensec Website: http://www.provensec.com version 3.1 Proof of concept uploadify.swf?movieName=%22catcheif!window.xwindow.x=1;confirm%27XSS%27//&.swf demo...

Kunstmaan CMS Open Redirect

Affected software: kunstmaan cms Type of vulnerability: redirect vulnerability URL: bundles.kunstmaan.be Discovered by: Provensec Website: http://www.provensec.com version: not specified on domain Proof of concept http://demo.bundles.kunstmaan.be/en/admin/media/delete/9?redirectUrl=http://google....

Subrion 3.3.0 Cross Site Request Forgery

Affected software: subrion Type of vulnerability: csrf to sql injection URL: http://demo.subrion.org Discovered by: Provensec Website: http://www.provensec.com version v3.3.0 Proof of concept no csrf protection on database form which made subrion to vulnerable to database injection vuln parameter...

Mambo 4.6.5 Cross Site Request Forgery / SQL Injection

Affected software: Mambo Type of vulnerability: csrf to sql injection URL: http://source.mambo-foundation.org/ Discovered by: Provensec Website: http://www.provensec.com version 4.6.5 Proof of concept no csrf token were used on sql query form so attacker can leverage csrf to execute sql query on...

Wonder CMS 0.6 Cross Site Scripting

Affected software: wonder cms Type of vulnerability: xss URL: wondercms.com Discovered by: Provensec Website: http://www.provensec.com version 0.6 Proof of concept http://wondercms.com/labs/06beta/?page=%22%3E%3Cimg%20src=d%20onerror=confirm%281%29;%3E...

UliCMS 8.0.1 Cross Site Request Forgery

Affected software: UliCMS 8.0.1 Type of vulnerability: admin add exploit csrf URL: http://en.ulicms.de/ Discovered by: Provensec Website: http://www.provensec.com version 8.0.1 Proof of concept...

X2Engine 5.0.4 Platinum Edition Cross Site Request Forgery

Affected software: x2 engine Type of vulnerability: csrf URL: http://demo.x2engine.com Discovered by: Provensec Website: http://www.provensec.com version :X2Engine 5.0.4 Platinum Edition Proof of concept x2 engine was not using any csrf token which causes a csrf issue which an attacker can use to...

3d Cart Cross Site Scripting

Affected software: 3d cart Type of vulnerability: xss URL: http://3dcart.com/ Discovered by: Provensec Website: http://www.provensec.com Description: Hosted Shopping Cart Software to Build an Online Store Proof of concept /admin/usersview.asp?error=%3Cimg/src=%22x%3E%22onerror=...

Netcat CMS 5.5 Cross Site Scripting

Affected software: netcat cms Type of vulnerability: cross site scripting URL: netcat.ru Discovered by: Provensec Website: http://www.provensec.com version: 5.5 Proof of concept Adding a new group with xss payload will lead to xss http://site/netcat/admin/usergroup.list payload used "...

BEdita CMS 3.5.1 Cross Site Scripting

Affected software: BEdita CMS Type of vulnerability: cross site scripting URL: bedita.com Discovered by: Provensec Website: http://www.provensec.com Description: BEdita is a web development framework that comes with a full featured CMS out of the box. Proof of concept javascript executes on login...

eFront Learning 3.6.11 Cross Site Scripting

Affected software: efrontlearning Type of vulnerability: stored xss URL: http://demo.efrontlearning.net/ Discovered by: Provensec Website: http://www.provensec.com Description: Open Source e-Learning Proof of concept version:eFront 3.6.11 goto addd new category...

Akeneo PIM Cross Site Scripting

Affected software: Akeneo Online Demo Type of vulnerability: stored xss URL: http://www.akeneo.com/demo/ Discovered by: Provensec Website: http://www.provensec.com Description:Akeneo is an open source Product Information Management PIM system designed for retailers looking for efficient answers t...

Collabtive 2.0 Cross Site Scripting

Affected software: collabtive Type of vulnerability: stored xss URL: http://www.collabtive.o-dyn.de/ Discovered by: Provensec Website: http://www.provensec.com Description: collabtive stored xss version:2.0 Proof of concept goto Collabtive add new project with xss payload and save it javascript...