1481 matches found
Email Subscribers & Newsletters < 2.9.1 - Multiple XSS & SQLi
The Email Subscribers & Newsletters – Simple and Effective Email Marketing WordPress Plugin WordPress plugin was affected by a Multiple XSS & SQLi security vulnerability...
WordPress Unite Gallery Lite Plugin 1.4.6 - Multiple Vulnerabilities
WordPress Unite Gallery Lite plugin version 1.4.6 suffers from cross site request forgery and remote SQL injection vulnerabilities. Title: Cross-Site Request Forgery & SQL Injection Vulnerabilities in Unite Gallery Lite Wordpress Plugin v1.4.6 Submitter: Nitin Venkatesh Product: Unite Gallery Lit...
Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution
Merethis Centreon - Unauthenticated blind SQLi and Authenticated Remote Command Execution CVEs: CVE-2015-1560, CVE-2015-1561 Vendor: Merethis - www.centreon.com Product: Centreon Version affected: 2.5.4 and prior Product description: Centreon is the choice of some of the world's largest companies...
SO Planning 1.32 - Multiple Vulnerabilities
SOPlanning - Simple Online Planning Tool multiple vulnerabilities CVEs: CVE-2014-8673, CVE-2014-8674, CVE-2014-8675, CVE-2014-8676, CVE-2014-8677 Vendor: http://www.soplanning.org/ Product: SOPlanning - Simple Online Planning Version affected: 1.32 and prior Product description: SO Planning is an...
Arab Portal 3 SQL Injection
In The Name Of ALLAH title : Arabportal 3 SQL injection vulnerability Exploit Title: Arabportal 3 registeration section SQL injection vulnerability Google Dork: inurl:members.php?action=signup Date: 2015/07/10 july 10th Exploit Author: ali ahmady -- Iranian Security Researcher snip3rirathotmail.c...
Joombri Freelance, pre 1.6.5, SQLi
JoomBri freelance extension pre 1.6.5. suffers major sqli exploit. No contact from developer, Notified by Ruth Cheesley...
ManageEngine Applications Manager DowntimeSchedulerServlet 'TASKID' Blind SQLi
The remote host is running a version of ManageEngine Applications Manager that is affected by a blind SQL injection vulnerability due to improper validation of user-supplied input to the 'TASKID' parameter in the 'DowntimeSchedulerServlet' servlet. A remote attacker can exploit this flaw to execu...
WordPress LeagueManager 3.9.11 SQL Injection
Exploit Title: WordPress LeagueManager SQLi Version: 3.9.11 Vendor: https://wordpress.org/plugins/leaguemanager Software Link: https://downloads.wordpress.org/plugin/leaguemanager.3.9.1.1.zip Author: javabudd Date: 06/01/2015 Tested on: Linux | Windows Vulnerabilities 2 ==========================...
WordPress Plugin Landing Pages 1.8.4 - Multiple Vulnerabilities
WordPress Plugin Landing Pages 1.8.4 - Multiple Vulnerabilities Title: Multiple vulnerabilities in WordPress plugin "WordPress Landing Pages" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/landing-pages/ Active installs: 20,000+...
WordPress Plugin NewStatPress 0.9.8 - Multiple Vulnerabilities
Title: Multiple vulnerabilities in WordPress plugin "NewStatPress" Author: Adrián M. F. - adrimf85atgmaildotcom Date: 2015-05-25 Vendor Homepage: https://wordpress.org/plugins/newstatpress/ Active installs: 20,000+ Vulnerable version: 0.9.8 Fixed version: 0.9.9 CVE: CVE-2015-4062, CVE-2015-4063...
GoAutoDial CE 3.3-1406088000 - Authentication Bypass / Arbitrary File Upload / Command Injection
Affected software: GoAutoDial Affected version: 3.3-1406088000 GoAdmin and previous releases of GoAutodial 3.3 Associated CVEs: CVE-2015-2842, CVE-2015-2843, CVE-2015-2844, CVE-2015-2845 Vendor advisory: http://goautodial.org/news/21 Abstract: Multiple vulnerabilties exist in the GoAutodial 3.3...
Betster (PHP Betoffice) Authentication Bypass and SQL Injection
?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / / / XXXXXX / / XXXXXX / / XXXXXX / ------' Exploit Title : Betster PHP Betoffice Authentication Bypass and SQ...
WPML <= 3.1.7.2 - Multiple Vulnerabilities (Including SQLi)
The sitepress-multilingual-cms WordPress plugin was affected by a Multiple Vulnerabilities Including SQLi security vulnerability...
Cacti < 0.8.6e Multiple Vulnerabilities
According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.6e. It is, therefore, potentially affected by the following vulnerabilities : - A PHP file inclusion vulnerability exists in 'topgraphheader.php' that allows remote...
ECCMS 1.0 Cross Site Scripting / SQL Injection
===================================================================== Advisory: ECCMS 1.0 - Multiple Vulnerabilities Author: R3VANBASTARD - Yogyakarta Dork: "Powered by Econnective" / Powered by Econnective inurl:/admin =====================================================================...
Cacti Superlinks 1.4-2 Code Execution / LFI / SQL Injection
!/bin/sh Exploit Title: Cacti - Superlinks Plugin 1.4-2 RCELFI via SQL Injection Date: 19/12/2014 Exploit Author: Wireghoul Software Link: http://docs.cacti.net/plugin:superlinks Identifiers: CVE-2014-4644, EDB-ID-33809 Exploit explanation through inline comments Patch provided at the end This is...
Joomla! Component com_hdflvplayer 2.1.0.1 - SQL Injection
Joomla! Component comhdflvplayer 2.1.0.1 - SQL Injection !/usr/bin/python Exploit Title : Joomla HD FLV 2.1.0.1 and below SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://www.hdflvplayer.net/ Software Link : http://www.hdflvplayer.net/downloadcount.php?pid=5 Dork google 1:...
Joomla! Component com_hdflvplayer < 2.1.0.1 - SQL Injection
!/usr/bin/python Exploit Title : Joomla HD FLV 2.1.0.1 and below SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://www.hdflvplayer.net/ Software Link : http://www.hdflvplayer.net/downloadcount.php?pid=5 Dork google 1: inurl:/component/hdflvplayer/ Dork google 2:...
Another WordPress Classifieds Plugin < 3.0 - SQLi & XSS
The WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds WordPress plugin was affected by a SQLi & XSS security vulnerability...
cmseasy 最新版SQLl注入（第八次绕WAF）
简要描述： 继续绕啊绕啊 详细说明： cmseasy 终于更新了 看了下对比文件，那修复无法吐槽 function LiveMessage$a global $db; $sessionid = $SESSION'sessionid'; $name = addslasheshtmlspecialchars$a'name'; $email = addslasheshtmlspecialchars$a'email'; $country = htmlspecialchars$a'country'; $phone = htmlspecialchars$a'phone'; $departmentid...