WiFi HD 8.1 - Directory Traversal / Denial of Service

Exploit Title: WiFi HD 8.1 - Directory Traversal and Denial of Service Date: 2015-05-27 Exploit Author: Wh1t3Rh1n0 Michael Allen Vendor Homepage: http://www.savysoda.com Software Link: http://www.savysoda.com/WiFiHD/ Version: 8.1 Apr 1, 2015 Tested on: iPhone Disclosure Timeline: 2015-05-30: Vend...

WordPress zM Ajax Login & Register Plugin 1.0.9 Local File Inclusion Vulnerability

Exploit for php platform in category web applications Exploit Title: CVE-2015-4153 - WordPress zM Ajax Login & Register Plugin Local File Inclusion Date: 2015/06/01 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://zanematthew.com/ Software Link:...

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting

Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link: https://wordpress.org/plugins/free-counter/ Version: 1.1 Tested on: WordPress 4.2.2...

Newsletter 4.3 SQL Injection

------------------------ Exploit Title : Newsletter 4.3 SQL Injection Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage: www.conpresso.de - www.conpresso4.de Google Dork ONE: intext:Module Newsletter 4.3 Google Dork TWO: Module Newsletter 4.3 by www.conpresso4.de Date ...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter in a process action to admin/login.php; 2 pageTitle, 3 currentproductid, or 4 cPath parameter to...

Comsenz SupeSite CMS 'title' field HTML injection vulnerability

Comsenz SupeSite CMS is a content management system CMS of China Comsenz Comsenz. The system provides information management , information publishing , information review , information classification , information field customization and other functions . An HTML injection vulnerability exists in...

Wireless Photo Transfer 3.0 iOS - File Inclusion Vulnerability

Exploit for iOS platform in category web applications Document Title: =============== Wireless Photo Transfer v3.0 iOS - File Include Vulnerability Product & Service Introduction: =============================== Transfer your photo without usb. The best wireless photo transfer app on the App Stor...

Wireless Photo Transfer 3.0 iOS - Local File Inclusion

Document Title: =============== Wireless Photo Transfer v3.0 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1492 Release Date: ============= 2015-05-12 Vulnerability Laboratory ID VL-ID:...

Wireless Photo Transfer 3.0 iOS - Local File Inclusion

Wireless Photo Transfer 3.0 iOS - Local File Inclusion Document Title: =============== Wireless Photo Transfer v3.0 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1492 Release Date: ============= 2015-05-12 Vulnerability...

WordPress Page Showcaser Boxes Plugin - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability via title field. Solution Upgrade the plugin...

WordPress Social Hashtags Plugin <= 2.0.0 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in new post title field. Solution Update the plugin...

WordPress Editorial Calendar Plugin <= 2.6 - Cross Site Scripting

This plugin is prone to a post title XSS vulnerability. Solution Upgrade the plugin...

WordPress Social Hashtags Plugin <= 2.0.0 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in new post title field. Solution Update the plugin...

WordPress Page Showcaser Boxes Plugin - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability via title field. Solution Upgrade the plugin...

Udemy: XSS on https://www.udemy.com/asset/export.html

Description https://www.udemy.com/asset/export.html is used to generate a content of a lecture and it will be dispalyed on https://www.udemy.com/staticx/udemy/flash/udemypresentation.player.swf?. https://www.udemy.com/asset/export.html contain json response but the content type is text/html,...

HTTP HTML Title Tag Content Grabber

Generates a GET request to the provided webservers and returns the server header, HTML title attribute and location header if set. This is useful for rapidly identifying interesting web applications en mass. This module requires Metasploit: https://metasploit.com/download Current source:...

VideoCharge Vanilla 3.16.4.06 - Local Buffer Overflow

VideoCharge Vanilla 3.16.4.06 - Local Buffer Overflow !/usr/bin/python Exploit Title: VideoCharge v3.16.4.06 Date: 10/May/2015 Author: @evilcomrade IRC freenode: vulnhub or offsec or corelan email: kwiha2003 at yahoo dot com Version: 3.16.4.06 Tested on: Win XP3 Software link:...

UniPDF Version 1.2 - 'xml' Buffer Overflow Crash PoC

Exploit for windows platform in category dos / poc Exploit Title: UniPDF v1.2 BufferOverflow, SEH overwrite DoS PoC Author : Avinash Kumar Thapa "-Acid" Date of Testing : 25th April 2015 Tested On : Windows XP- Service Pack 3 && Windows 7 Home Basic Vendor Homepage: http://unipdf.com/ Software...

Multiple Cross-Site Scripting Vulnerabilities in SearchBlox

SearchBlox is the U.S. SearchBlox company a set of open source and free of charge based on Lucene full-text search engine toolkit to build enterprise search and analytics solutions. The program provides a Web-based management interface , you can manage the entire search system . A cross-site...

Drupal Node Invite Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Node Invite is one of the modules that is similar to RSVP sending invitations via email. A cross-site scripting vulnerability exists in the Drupal Node Invite module versions prior to...