1481 matches found
CVE-2016-1000113
CVE-2016-1000113 affects Joomla! Huge-IT Image Gallery extension (v1.1.5). Reported XSS and SQL injection flaws stem from insufficient input validation in the gallery plugin (notably id parameter handling in admin/gallery.php). Impact per the records includes potential disclosure or modification ...
CVE-2015-1000011: Improper Neutralization of Special Elements used in an SQL Command
Blind SQL Injection in wordpress plugin dukapress v2.5.9...
PT-2016-4505
Name of the Vulnerable Software and Affected Versions Huge IT Gallery version 1.1.5 Description The issue involves XSS and SQLi in the software, which can lead to security breaches. Recommendations For version 1.1.5, update to a newer version that contains a fix for this issue, if available. At t...
Joomla com_aicontactsafe Arbitrary File Upload / SQL injection Vulnerability
Exploit for php platform in category web applications Exploit Title : Joomla comaicontactsafe Arbitrary File Upload / SQL injection Vulnerability Exploit Author : xBADGIRL21 Dork : inurl:index.php?option=comaicontactsafe Software link :...
Simpla Admin Single-adsID SQL Injection / Shell Upload Vulnerabilities
Exploit for php platform in category web applications Exploit Title : Simpla Admin Single-adsID SQL Injection / Shell Upload Exploit Author : xBADGIRL21 Dork : intext:connexion "single-ads.php?ID=" or inurl:.single-ads.php?ID= Software link :...
Raptor Web Application Firewall
Raptor Web Application Firewall Raptor Web Application Firewall is a simple web application firewall made in C, using KISS principle , to make poll use select function, is not better than epoll or kqueue from BSD but is portable, the core of match engine using DFA to detect XSS, SQLi and path...
SolarWinds Storage Resource Monitor Profiler < 6.2.3 Hotfix 1 RulesMetaData SQLi RCE
The version of SolarWinds Storage Resource Monitor SRM Profiler formerly SolarWinds Storage Manager running on the remote host is prior to 6.2.3 Hotfix 1. It is, therefore, affected by a remote code execution vulnerability in ScriptServlet due to a failure to sanitize user-supplied input to the...
WordPress Plugin Ultimate Membership Pro 3.3 - SQL Injection
Vendor Homepage: http://wpindeed.com/ Software Link: http://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253 Version: 3.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Unauthenticated Blind SQLi, Unauthenticated Payment Bypass Time line: Found 07-Jun-2016, Vendor notified...
Joomla Publisher Pro Component (com_publisher) - SQL Injection
Exploit for php platform in category web applications Exploit Title: Joomla compublisher component SQL Injection vulnerability Exploit Author: s0nk3y Date: 21-06-2016 Software Link: http://extensions.joomla.org/extension/publisher-pro Category: webapps Version: All Tested on: Ubuntu 16.04 1...
BookingWizz Booking System 5.5 - Multiple Vulnerabilities
BookingWizz Booking System 5.5 - Multiple Vulnerabilities 1. ADVISORY INFORMATION ======================================== Title: BookingWizz Default username/password: admin/pass"; PR2 - Cross Site Scripting ======================================== File : eventList.php // Improper user input...
BookingWizz Booking System < 5.5 - Multiple Vulnerabilities
ADVISORY INFORMATION ======================================== Title: BookingWizz Default username/password: admin/pass"; PR2 - Cross Site Scripting ======================================== File : eventList.php // Improper user input validation on Line 24: $serviceID =...
WordPress Plugin User Meta Manager 3.4.6 - Blind SQL Injection
WordPress Plugin User Meta Manager 3.4.6 - Blind SQL Injection Exploit Title: WordPress User Meta Manager Plugin Blind SQLI Discovery Date: 2015/12/28 Public Disclosure Date: 2016/02/04 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage:...
Mail.ru: [afisha.mail.ru] SQL Injection
Добрый день. Параметр id попадает в SQL запрос без фильтрации. Вектор атаки - Union Based SQLi PoC http://mmkf.afisha.mail.ru/imgview.html?id=3713444279+and0unionselectconcatws0x2c,version,@@versioncompileos вывод в сорцах страницы - 5.0.92-community-log:unknown-linux-gnu...
Project Arsenal X - As HackTheGame But Real
Project Arsenal X New version of my Arsenal X written in Delphi with the following options: + Gmail Inbox + Whois Client + Table + Downloader + Get IP + Locate IP + K0bra SQLI Scanner + Crack multiple hashes + Search admin panel + Port Scanner + Multi Cracker with support for FTP, TELNET, POP3 +...
Sysaid Helpdesk Software 14.4.32 b25 - SQL Injection Vulnerability
Exploit for windows platform in category remote exploits Exploit Title: Sysaid Helpdesk Software Unauthenticated SQLi Date: 28.11.2015 Exploit Author: hland Vendor Homepage: https://www.sysaid.com/ Version: v14.4.32 b25 Tested on: Windows 7, Windows 10 Blog post:...
SysAid Help Desk Software 14.4.32 b25 - SQL Injection (Metasploit)
SysAid Help Desk Software 14.4.32 b25 - SQL Injection Metasploit Exploit Title: Sysaid Helpdesk Software Unauthenticated SQLi Date: 28.11.2015 Exploit Author: hland Vendor Homepage: https://www.sysaid.com/ Version: v14.4.32 b25 Tested on: Windows 7, Windows 10 Blog post:...
CVE-2015-7319 - SQL Injection in Appointment Booking Calendar 1.1.7 WordPress plugin
Vulnerability title: SQL Injection in Appointment Booking Calendar 1.1.7 WordPress plugin CVE: CVE-2015-7319 Vendor: WordPress DWBooster Product: Appointment Booking Calendar Affected version: 1.1.7 Fixed version: 1.1.8 Reported by: Ibйria Medeiros Vulnerability Details: ===================== It...
FAROL - SQL Injection
FAROL - SQL Injection Exploit Title: Web Application Farol with anauthenticated SQLi injection Date: 2015-09-16 Exploit Author: Thierry Fernandes Faria a.k.a SoiL thierryfariaa at gmail dot com Vendor Homepage:http://www.teiko.com.br/pt/solucoes/infraestrutura-em-ti/farol Version: All CVE :...
WordPress CP Multi View Event Calendar Plugin 1.1.7 - SQL Injection
Exploit Title: WordPress cp-multi-view-calendar.1.1.7 Unauthenticated SQL injection vulnerabilities Date: 2015-07-10 Google Dork: Index of /wordpress/wp-content/plugins/cp-multi-view-calendar Vendor Homepage: http://wordpress.dwbooster.com/ Software Link:...
