PHP Press Release Cross-Site Scripting Vulnerability

PHP Press Release is a software that allows you to manage your organization's press releases via the web, and the public can access recent releases via the web. A stored cross-site scripting vulnerability exists in the title parameter of the administration.php page of PHP Press Release, which can...

Stored Cross-Site Scripting Vulnerability in the Location of Posted Messages in the Web Version of Xinhao Office Software

Xinhoo builds an Internet-based enterprise management platform for enterprises. A stored cross-site scripting vulnerability exists in the web version of Xinhao Office Software at the location of the published message. Due to the use of ordinary user login xiaoqiao, daqiao, in the " send to "...

XenForo ToggleME 3.1.2 Cross Site Scripting

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenForo ToggleME plugin Vendor URL: https://xenforo.com/community/resources/toggleme.137/ Type: Cross-Site Scripting CWE-79 Date found: 2016-09-06 Date published: 2016-09-11 CVSSv3 Score: 5....

SQL Injection Vulnerability in the Title Parameter of the Digital Newspaper System/www/index.php Page of Pleasant Reading Media

Joy Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. There is a SQL injection vulnerability in this product, the vulnerability URL is: /www/index.php?mod=admin&con=deliver&title=1, the vulnerability parameter is: title, the attacker can use the vulnerability to...

WordPress Plugin RB Agency 2.4.7 - Local File Disclosure

WordPress Plugin RB Agency 2.4.7 - Local File Disclosure Exploit Title : WordPress RB Agency 2.4.7 Plugin - Local File Disclosure Exploit Author : Persian Hack Team Vendor Homepage : http://rbplugin.com/ Category Webapps Tested on Win Version : 2.4.7 Date 2016/09/03 PoC The Vulnerable page is...

KV Site Admin CMS 3.0 SQL Injection

Exploit Title : KV Site Admin CMS 3.0 SQL injection Vulnerability Exploit Author : xBADGIRL21 Dork : e.World Technology Ltd. All rights reserved "Admin Area - Version 3.0" Version: 3.0 MyBlog: http://xbadgirl21.blogspot.com Tested on: BackBox skype:xbadgirl21 Video Proof :...

EaseUS CMS Message Storage Type Cross-site Scripting Vulnerability

EECO CMS is a marketing enterprise website system based on SEO development. A stored cross-site scripting vulnerability exists in the EE CMS message, due to the program not filtering the title and so on. Allow attackers to exploit the vulnerability to carry out cross-site attacks...

Ian Dunn: Multiple XSS in Camptix Event Ticketing Plugin

Hi, As discussed in 151561 submitting the report here. I have got some more bugs in Camptix Event Ticketing plugin. Well, the first one is a ticket page xss caused by the Ticket Title And the second one is kind of self-xss, caused by also the Ticket title of the plugin but in the coupons page. I...

OLX: stored XSS in olx.pl - ogloszenie TITLE element - moderator acc can be hacked

Hello, The OLX.PL is vulnerable to stored XSS attack. When adding new advertisement, it is possible to put a payload in its title here I used Titlealert1 I see ads are being pre-moderated, however it can remain uncaught also the length limit in title field is enough to insert into it e.g. a BeEF...

Linux/x86-64 - Ncat Shellcode (SSL, MultiChannel, Persistant, Fork, IPv4/6, Password) (176 bytes)

include include // Exploit Title: Linux 64bit Ncat + SSL + MultiChannel + Persistant + Fork + IPv4/6 + Password 176byte // Date: 7/5/2016 // Exploit Author: CripSlick // Tested on: Kali 2.0 // Version: Ncat: Version 7.01 // email protected // OffSec ID: OS-20614 // http://50.112.22.183/...

Updated PhD Thesis Title

Yesterday I posted Latest PhD Thesis Title and Abstract. One of my colleagues Ben Buchanan subsequently contacted me via Twitter and we exchanged a few messages. He prompted me to think about the title. Later I ruminated on the title of a recent book by my advisor, Dr. Thomas Rid. He wrote Cyber...

XuezhuLi FileSharing Path Traversal

Exploit Title: XuezhuLi FileSharing - Path Traversal Vulnerability Date: 2016-06-23 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: https://github.com/XuezhuLi Software Link: https://github.com/XuezhuLi/FileSharing/archive/master.zip Version: Latest commit Tested on:...

XuezhuLi FileSharing Cross Site Request Forgery

document.forms.csrfpoc.submit; cat /srv/userlists.txt aaaa csrftest --...

Radiant CMS 1.1.3 Cross Site Scripting

Exploit Title: Radiant CMS 1.1.3 - Mutiple Persistant XSS Vulnerabilities Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Exploit Author Twitter: twitter.com/davidsilveiro Vendor Homepage: http://radiantcms.org/ Software Link: http://radiantcms.org/download/ Date:...

Radiant CMS 1.1.3 - Multiple Persistent Cross-Site Scripting

Exploit for ruby platform in category web applications Exploit Title: Radiant CMS 1.1.3 - Mutiple Persistant XSS Vulnerabilities Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Exploit Author Twitter: twitter.com/davidsilveiro Vendor Homepage: http://radiantcms.org/...

Airia Cross Site Request Forgery

document.forms.csrfpoc.submit;...

Speed Tony CMS App_Site/SiteSearch. the aspx file Title parameter SQL injection vulnerability

No description provided by source...

SUSE: Security Advisory for ImageMagick (SUSE-SU-2016:1570-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability

Document Title: =============== CM Ad Changer 1.7.7 WP Plugin - Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1856 Release Date: ============= 2016-06-13 Vulnerability Laboratory ID VL-ID: ====================================...

Electroweb Online Examination System 1.0 SQL Injection

Exploit Title: Online examination system 1.0 - SQL Injection Google Dork: inurl:showtest.php?subid= Date: 2016/06/05 Exploit Author: Ali Ghanbari Vendor Homepage: http://www.onlinefreeprojectdownload.com Sofware Link :...