Arab Portal 3 SQL Injection

In The Name Of ALLAH title : Arabportal 3 SQL injection vulnerability Exploit Title: Arabportal 3 registeration section SQL injection vulnerability Google Dork: inurl:members.php?action=signup Date: 2015/07/10 july 10th Exploit Author: ali ahmady -- Iranian Security Researcher snip3rirathotmail.c...

Joombri Freelance, pre 1.6.5, SQLi

JoomBri freelance extension pre 1.6.5. suffers major sqli exploit. No contact from developer, Notified by Ruth Cheesley...

ManageEngine Applications Manager DowntimeSchedulerServlet 'TASKID' Blind SQLi

The remote host is running a version of ManageEngine Applications Manager that is affected by a blind SQL injection vulnerability due to improper validation of user-supplied input to the 'TASKID' parameter in the 'DowntimeSchedulerServlet' servlet. A remote attacker can exploit this flaw to execu...

WordPress LeagueManager 3.9.11 SQL Injection

Exploit Title: WordPress LeagueManager SQLi Version: 3.9.11 Vendor: https://wordpress.org/plugins/leaguemanager Software Link: https://downloads.wordpress.org/plugin/leaguemanager.3.9.1.1.zip Author: javabudd Date: 06/01/2015 Tested on: Linux | Windows Vulnerabilities 2 ==========================...

WordPress Plugin Landing Pages 1.8.4 - Multiple Vulnerabilities

WordPress Plugin Landing Pages 1.8.4 - Multiple Vulnerabilities Title: Multiple vulnerabilities in WordPress plugin "WordPress Landing Pages" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/landing-pages/ Active installs: 20,000+...

WordPress Plugin NewStatPress 0.9.8 - Multiple Vulnerabilities

Title: Multiple vulnerabilities in WordPress plugin "NewStatPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/newstatpress/ Active installs: 20,000+ Vulnerable version: 0.9.8 Fixed version: 0.9.9 CVE: CVE-2015-4062, CVE-2015-4063...

GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection

Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...

Betster (PHP Betoffice) Authentication Bypass and SQL Injection

?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / / / XXXXXX / / XXXXXX / / XXXXXX / ------' Exploit Title : Betster PHP Betoffice Authentication Bypass and SQ...

WPML <= 3.1.7.2 - Multiple Vulnerabilities (Including SQLi)

The sitepress-multilingual-cms WordPress plugin was affected by a Multiple Vulnerabilities Including SQLi security vulnerability...

Cacti < 0.8.6e Multiple Vulnerabilities

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.6e. It is, therefore, potentially affected by the following vulnerabilities : - A PHP file inclusion vulnerability exists in 'topgraphheader.php' that allows remote...

ECCMS 1.0 Cross Site Scripting / SQL Injection

===================================================================== Advisory: ECCMS 1.0 - Multiple Vulnerabilities Author: R3VANBASTARD - Yogyakarta Dork: "Powered by Econnective" / Powered by Econnective inurl:/admin =====================================================================...

Cacti Superlinks 1.4-2 Code Execution / LFI / SQL Injection

!/bin/sh Exploit Title: Cacti - Superlinks Plugin 1.4-2 RCELFI via SQL Injection Date: 19/12/2014 Exploit Author: Wireghoul Software Link: http://docs.cacti.net/plugin:superlinks Identifiers: CVE-2014-4644, EDB-ID-33809 Exploit explanation through inline comments Patch provided at the end This is...

Joomla! Component com_hdflvplayer < 2.1.0.1 - SQL Injection

!/usr/bin/python Exploit Title : Joomla HD FLV 2.1.0.1 and below SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://www.hdflvplayer.net/ Software Link : http://www.hdflvplayer.net/downloadcount.php?pid=5 Dork google 1: inurl:/component/hdflvplayer/ Dork google 2:...

Joomla! Component com_hdflvplayer 2.1.0.1 - SQL Injection

Joomla! Component comhdflvplayer 2.1.0.1 - SQL Injection !/usr/bin/python Exploit Title : Joomla HD FLV 2.1.0.1 and below SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://www.hdflvplayer.net/ Software Link : http://www.hdflvplayer.net/downloadcount.php?pid=5 Dork google 1:...

Another WordPress Classifieds Plugin < 3.0 - SQLi & XSS

The WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds WordPress plugin was affected by a SQLi & XSS security vulnerability...

cmseasy 最新版SQLl注入（第八次绕WAF）

简要描述： 继续绕啊绕啊 详细说明： cmseasy 终于更新了 看了下对比文件，那修复无法吐槽 function LiveMessage$a global $db; $sessionid = $SESSION'sessionid'; $name = addslasheshtmlspecialchars$a'name'; $email = addslasheshtmlspecialchars$a'email'; $country = htmlspecialchars$a'country'; $phone = htmlspecialchars$a'phone'; $departmentid...

Etiko CMS Cross Site Scripting / SQL Injection

SQL Injection & XSS on Etiko CMS. Risk: High CWE number: CWE-89,CWE-79 Date: 13/10/2014 Vendor: www.etikweb.com Version: All Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on: Windows 8 ; Chrome ; Sqlmap 1.0-dev-nongit-20140906 Vulnerables Files: /index.php & /loja/index.php...

WordPress Content Audit 1.6 Blind SQL Injection

Details ================ Software: Content Audit Version: 1.6 Homepage: http://wordpress.org/plugins/content-audit/ Advisory report: https://security.dxw.com/advisories/blind-sqli-vulnerability-in-content-audit-could-allow-a-privileged-attacker-to-exfiltrate-password-hashes/ CVE: CVE-2014-5389...

Typo3 Extension JobControl 2.14.0 - Cross-Site Scripting SQL Injection

Typo3 Extension JobControl 2.14.0 - Cross-Site Scripting SQL Injection Mogwai Security Advisory MSA-2014-02 ---------------------------------------------------------------------- Title: JobControl dmmjobcontrol Multiple Vulnerabilities Product: dmmjobcontrol Typo3 Extension Affected versions:...

Joomla Face Gallery 1.0 SQL Injection / File Download

Exploit Title : Joomla Face Gallery 1.0 Multiple Vulnerabilities Exploit Author : Claudio Viviani Vendor Homepage : https://www.apptha.com Software Link : https://www.apptha.com/downloadable/download/sample/sampleid/150 Dork Google: inurl:option=comfacegallery Date : 2014-09-17 Tested on : Window...