WordPress Ultimate Membership Pro 3.3 Plugin - SQL Injection

Exploit for php platform in category web applications Vendor Homepage: http://wpindeed.com/ Software Link: http://codecanyon.net/item/ultimate-membership-pro-wordpress-plugin/12159253 Version: 3.3 Tested on: Debian 8, PHP 5.6.17-3 Type: Unauthenticated Blind SQLi, Unauthenticated Payment Bypass...

payments.westernunion.com XSS vulnerability

Vulnerable URL: https://payments.westernunion.com/uploads/?1 Details: Description| Value ---|--- Patched:| Yes, at 21.01.2017 Latest check for patch:| 21.01.2017 10:53 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| ...

海康威视视频接入网关系统 /userInfo/roleInfo.php等34处 SQL注入漏洞

0x01漏洞简介 海康威视视频接入网关系统采用PHP+SQLite架构，其在以下34处均存在注入漏洞： /userInfo/roleInfo.php /userInfo/userInfo.php /data/fetchRoleTreeJson.php /deviceConfig/configDeviceInfo.php /transformServer/serverConfigInfo.php /cameraConfig/transferInfo.php /data/deviceAndCameraListData.php /data/deviceTypeData.php...

Threat Outbreak Alert RuleID22482: Email Messages Distributing Malicious Software on April 26, 2016

Medium Alert ID: 44835 First Published: 2016 April 26 16:37 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22482 may contain the following files: Name | Si...

'Hacking Team' Loses License to Sell Surveillance Malware Outside Europe

Hacking Team – the infamous Italy-based spyware company that had more than 400 GB of its confidential data stolen last year – is facing another trouble. This time not from other hackers, but from its own government. Hacking Team is infamous for selling surveillance spyware to governments and...

Western Union - Paybybank - WebView JavaScript enabled, WebView files access vulnerabilities

HackApp vulnerability scanner discovered that application Western Union - Paybybank published at the 'play' market has multiple vulnerabilities...

Credit Union 1 - Alaska - Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Credit Union 1 - Alaska published at the 'play' market has multiple vulnerabilities...

Apple, Google Faced All Writs Act Orders

The American Civil Liberties Union has dug up more proof that from the get-go the FBI’s attempt to crack open an iPhone used by the San Bernardino shooter Syed Rizwan Farook was not just about the one phone. The ACLU found court documents and on Wednesday published an interactive map visualizing...

ec.europa.eu XSS vulnerability

Vulnerable URL: http://ec.europa.eu/regionalpolicy/hu/atlas/managing-authorities/[email protected]%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 11.04.2016 Latest check for patch:| 11.04.2016 03:26 GMT Vulnerability type:| XSS...

unionleader.com XSS vulnerability

Vulnerable URL: http://www.unionleader.com/apps/pbcs.dll/search?Category=SEARCH%22/%3E%3Csvg/onload=alert%28%27XSSPOSED%27%29%3E=1=Bedford Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 08:01 GMT Vulnerability type:| XSS Vulnerability status:|...

SM Soft Tech CMS 1.0 SQL Injection

========================================================== + Title :- SM SOFT TECH CMS - SQL INJECTION + Date :- 24 - MAR - 2016 + Vendor Homepage :- http://www.smsofttech.net/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks :...

uniongas.com Open Redirect vulnerability

Vulnerable URL: https://www.uniongas.com/scripts/ntlinktrack.exe?http://xssposed.org Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 21:36 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 146375 Googl...

汇能网站群管理系统 researchinfo_dan.jsp 参数researchId SQL注入漏洞

0x01漏洞简介 汇能网站群管理系统广泛应用于政府部门和国企，用户量较大。其在/main/model/childcatalog/researchinfodan.jsp由于对参数researchId过滤不严格，导致出现SQL注入漏洞。远程攻击者可以利用union方式，执行SQL指令，获取敏感信息。 0x02 Google Dork 0x03漏洞证明 SQL注入漏洞文件位置： /main/model/childcatalog/researchinfodan.jsp?researchId=1...

PHPLib 7.4 - SQL Injection

PHPLib 7.4 - SQL Injection PHPLib SQL Injection Vendor: PHPLib Product: PHPLib Version: newid=true; $this-name = $this-cookiename==""?$this-classname:$this-cookiename; if "" == $id $this-newid=false; switch $this-mode case "get": $id = isset$HTTPGETVARS$this-name ?...

完美Bypass云锁最新版(V1.6.153)SQL注入防护规则(可UNION)

简要描述： 完美Bypass云锁最新版V1.6.153SQL注入防护规则可UNION 详细说明： 云锁版本： Mysql UNION语法 http://.../doc/refman/5.5/en/union.html SELECT ... UNION ALL | DISTINCT SELECT ... UNION ALL | DISTINCT SELECT ... 上回提到了这个union all http://.../bugs/wooyun-2016-0170481 云锁在过滤危险请求的时候两个敏感字段相邻就会被干掉，但是两个敏感字段中间"插入"点什么的话就不会被匹配到。 distin...

Mail.ru: [3k.mail.ru] SQL Injection

Добрый день. Функция поиска уязвимо к атаке SQL Injection. Вектор атаки - Union Based PoC. http://3k.mail.ru/info/library/index.php?obj=cat&id=212&searchST='+and+0+union+select+1,2,concatws0x3a,user,version,4,5,6,7-- a Вывод на странице: master3k@localhost:5.0.90-log...

Mail.ru: [orsotenslimselfie.lady.mail.ru] SQL Injection

Добрый день. GET параметр lastid уязвимо к SQL иньекции. Вектор атаки Union Based. PoC http://orsotenslimselfie.lady.mail.ru/ajax/contest?perPage=20&lastid=7913+union+select+concatversion,0x3a,user,2,3,4,version,6,7,8,9,10--+ вывод в JSON респонсе - 5.0.92-community-log:[email protected]...

Timeclock 0.995 SQL Injection

Exploit Title : Multiple SQL injections Author:Marcela Benetrix Date: 02/03/2016 version: 0.995 older version may be vulnerable too software link:http://timeclock-software.net Timeclock software Timeclock-software.net's free software product will be a simple solution to allow your employees to...

Mail.ru: [afisha.mail.ru] SQL Injection

Добрый день. Параметр id попадает в SQL запрос без фильтрации. Вектор атаки - Union Based SQLi PoC http://mmkf.afisha.mail.ru/imgview.html?id=3713444279+and0unionselectconcatws0x2c,version,@@versioncompileos вывод в сорцах страницы - 5.0.92-community-log:unknown-linux-gnu...

Western Union Cross Site Scripting

Document Title: =============== Western Union CN Bug Bounty 6 - Client Side Cross Site Scripting Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1657 Release Date: ============= 2015-12-14 Vulnerability Laboratory ID VL-ID:...