205 matches found
Remote Code Execution (RCE)
yoast/wordpress-seo is vulnerable to remote code execution. An SEO Manager is able to execute arbitrary OS commands via a ZIP import through a race condition vulnerability in unzipfile in admin/import/class-import-settings.php...
CVE-2018-19370
The CVE-2018-19370 entry concerns Yoast SEO (wordpress-seo) plugin for WordPress, specifically versions before 9.2.0. A race-condition in unzip_file (admin/import/class-import-settings.php) allows an SEO Manager to execute OS commands via a ZIP import. Public sources in the connected documents co...
CVE-2018-17835
GetSimple CMS 3.3.15 is affected by CVE-2018-17835. The issue is a stored XSS: an administrator can inject malicious payload via the admin/settings.php Custom Permalink Structure parameter, which then contaminates any page created at the admin/pages.php URI. The vulnerability is rooted in imprope...
CVE-2017-16641
lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the pathrrdtool parameter in an action=save request to settings.php...
CVE-2017-16641
lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the pathrrdtool parameter in an action=save request to settings.php...
CVE-2017-16641
lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the pathrrdtool parameter in an action=save request to settings.php...
WordPress MiniMax Plugin <= 2.0.2 - Cross Site Scripting
This vulnerability is in ./page-layout-builder/includes/layout-settings.php. Solution Update the plugin...
Wordpress Spider Video Player插件-settings.php文件-跨站脚本漏洞
No description provided by source...
JoomShopping - Blind SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: JoomShopping Blind Sql injection Google Dork: allinurl:"/modules/modjshoppingproductswfl/js/" Date: 2015-07-24 Exploit Author: Mormoroth Vendor Homepage: http://www.webdesigner-profi.de Software Link:...
JoomShopping - Blind SQL Injection
JoomShopping - Blind SQL Injection Exploit Title: JoomShopping Blind Sql injection Google Dork: allinurl:"/modules/modjshoppingproductswfl/js/" Date: 2015-07-24 Exploit Author: Mormoroth Vendor Homepage: http://www.webdesigner-profi.de Software Link:...
JoomShopping - Blind SQL Injection
Exploit Title: JoomShopping Blind Sql injection Google Dork: allinurl:"/modules/modjshoppingproductswfl/js/" Date: 2015-07-24 Exploit Author: Mormoroth Vendor Homepage: http://www.webdesigner-profi.de Software Link: http://www.webdesigner-profi.de/joomla-webdesign/joomla-shop/downloads.html...
CVE-2015-2967
Cross-site scripting XSS vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
DEBIAN-CVE-2015-2967
Cross-site scripting XSS vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-2967
Cross-site scripting XSS vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-2967
Cross-site scripting XSS vulnerability in settings.php in Cacti before 0.8.8d allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-2967
Cacti Multiple Vulnerabilities (CVE-2015-2967) : The affected product is Cacti, specifically versions before 0.8.8d. The vulnerability is an XSS in the settings.php script that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The underlying issue is a failur...
Cacti vulnerable to cross-site scripting
Overview Cacti is a web application that graphs stored data collected from network devices. Cacti contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing parameters in settings.php. Daiki Fukumori of Cyber Defense Institute, Inc. and Masako Ohno reported this vulnerabilit...
MediaSuite.ca File Disclosure
. | | / | | \ \ | | \ / | |\ / / /\ \ / \ | / ^ / / || / / / / /\ /\ \ \ \ | / \ / http://twitter.com/h4SEC / \ | \ \ Proof Video: https://www.youtube.com/watch?v=7yxbfD1YK8Y / // / \ / My + Author : KnocKout E-Mail : [email protected] Twitter: http://twitter.com/h4SEC HomePage :...
WordPress Survey and Poll Blind SQL Injection Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...