310 matches found
Invision Power Board 1.x?2.x3.x - Admin Takeover
Invision Power Board 1.x?2.x3.x - Admin Takeover IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type ...
Invision Power Board 1.x / 2.x / 3.x Admin Account Takeover
IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type of vulnerability: Logical Vulnerability / Bad...
Calendar Script Easy Membership Management Application Persistent XSS Vulnerability
Exploit for php platform in category web applications Advisory:Calendar Script Easy Membership Management ApplicationE.M.M.A Persistent XSS Vulnerability Version:1.2 Vendor URL: http://calendarscripts.info/emma/ Demo Link: http://demo.pimteam.net/emma/admin.php Author: Viknesvaran Sittaramane...
WordPress Cimy User Extra Fields 2.3.7 Shell Upload
Exploit Title: wordpress plugin Cimy User Extra Fields Arbitrary File Upload Vulnerability Google Dork: inurl:"inurl:/wp-content/CimyUserExtraFields" Date: 07/18/2012 Author: Crim3R plugin download Link : http://downloads.wordpress.org/plugin/cimy-user-extra-fields.2.3.7.zip Version: 2.3.7 Tested...
ATutor 2.0.3 Cross Site Scripting
TITLE ....... ATutor DATE ........ .0.2012 AUTOHR ...... http://hauntit.blogspot.com SOFT LINK ... http:// VERSION ..... 2.0.3 TESTED ON ... LAMP ----------------------------------------------------------------------- 1. What is this? 2. What is the type of vulnerability? 3. Where is bug : 4...
SeedWiki Cross Site Scripting
Exploit Title: SeedWiki Cross Site Scripting Date: 8.02.2012 Author: Sony Software Link: http://www.seedwiki.com/ Web Browser : Mozilla Firefox Blog : http://st2tea.blogspot.com PoC: http://st2tea.blogspot.com/2012/02/seedwiki-cross-site-scripting.html...
XSS, Redirector и IAA уязвимости в MyBB
Здравствуйте 3APA3A! Сообщаю вам о найденных мною Cross-Site Scripting, URL Redirector Abuse и Insufficient Anti-automation уязвимостях в MyBB. Для XSS и URL Redirector Abuse используется рабочий аккаунт на уязвимом сайте. О подобных атаках я писал в статье Атаки на незащищённые логин формы...
phpBB MOD 2.0.19 - Invitation Only (PassCode Bypass)
PHPBB MOD 2.0.19 Invitation Only PassCode Bypass vulnerability ------------------------------------------------------------------------------- 0 | | | | | | TM 1 | | | | | | 0 | / | ' \ / | ' \ / |/ | |/ / \ '| ' \ / \ | 1 / / | | | | / | | | | | | | / | | | | | / | 0 //|| ||| || ||,|||\|||...
THQ.com SQL Injection
This is pretty much because I want to embarrass these assholes. See: http://gamepolitics.com/2010/06/14/exec-thq-anti-used-game-initiative-could-make-everyone-happy SQLi 1: http://www.thq.com/us/mythq/register?contentType=GAMEALERT&alertGame='4896 This one is pretty obvious. It's an injection via...
phpAutoVideo - Cross-Site Request Forgery
Exploit Title: phpAutoVideo csrf SoftWare:https://secure.agaresmedia.com/v6/products/phpautovideo Dork: Copyright Agares Media phpautovideo Author: GoLdeN-z3r0 ----------------------------------------------------------------- | PoC : |...
Open Auto Classifieds 1.5.9 - Multiple Vulnerabilities
Open Auto Classifieds 1.5.9 - Multiple Vulnerabilities MorningStar Security - Advisory http://www.morningstarsecurity.com/ Multiple security issues in Open Auto Classifieds 1. Advisory Information ---------------------------------------------------------------------------------------------- Title...
Open Auto Classifieds 1.5.9 - Multiple Vulnerabilities
MorningStar Security - Advisory http://www.morningstarsecurity.com/ Multiple security issues in Open Auto Classifieds 1. Advisory Information ---------------------------------------------------------------------------------------------- Title: Multiple security issues in Open Auto Classifieds...
CVE-2008-6772
The CVE affects YourPlace 1.0.2 and earlier where login/register_form.php does not verify that a username already exists during account creation, allowing a remote attacker to bypass access restrictions by registering a new account with a target user’s username. Documented impact is a Partial con...
Unfixed XSS vulnerability at www.student.se
Security researcher Uber0n, has submitted on 02/06/2008 a cross-site-scripting XSS vulnerability affecting www.student.se, which at the time of submission ranked 81299 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/06/2008. It is currently...
CVE-2006-5457
Multiple cross-site scripting XSS vulnerabilities in the registration form in Casinosoft Casino Script Masvet 3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 surname field...
CVE-2006-5457
Casinosoft Casino Script (Masvet) 3.2 contains multiple XSS vulnerabilities in its registration form, exploitable via the name or surname fields to inject arbitrary script/HTML. Remote exploitation is described; impact is limited to partial integrity and client-side exposure per the CVSS metrics ...
CVE-2006-5457
Multiple cross-site scripting XSS vulnerabilities in the registration form in Casinosoft Casino Script Masvet 3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 surname field...
CVE-2006-2305
Multiple cross-site scripting XSS vulnerabilities in Jadu CMS allow remote attackers to inject arbitrary web script or HTML via the 1 forename, 2 surname, 3 regemail, 4 emailconf, 5 company, 6 city, 7 postcode, or 8 telephone parameters to site/scripts/register.php. NOTE: the provenance of this...
CVE-2006-2305
Multiple cross-site scripting XSS vulnerabilities in Jadu CMS allow remote attackers to inject arbitrary web script or HTML via the 1 forename, 2 surname, 3 regemail, 4 emailconf, 5 company, 6 city, 7 postcode, or 8 telephone parameters to site/scripts/register.php. NOTE: the provenance of this...