DiskBoss Enterprise 8.2.14 Buffer Overflow

!/usr/bin/python Exploit Title : DiskBoss Enterprise v8.2.14 - 'Import Command' Buffer Overflow Discovery by : Anurag Srivastava Email : [email protected] Website : www.pyramidcyber.com Discovery Date : 22/08/2017 Software Link :...

Disk Pulse Enterprise 9.9.16 Buffer Overflow

!/usr/bin/python Exploit Title : Disk Pulse Enterprise 9.9.16 - 'Import Command' Buffer Overflow Discovery by : Anurag Srivastava Email : [email protected] Website : www.pyramidcyber.com Discovery Date : 21/08/2017 Software Link :...

MessengerScan 1.05 - Local Buffer Overflow (PoC) Exploit

Exploit for windows platform in category dos / poc !/usr/bin/python Exploit Title : MessengerScan v1.05 Hostname/IP Field SEH/EIP Overwrite POC Discovery by : Anurag Srivastava Email : email protected Discovery Date : 18/08/2017 Software Link :...

MessengerScan 1.05 SEH / EIP Overwrite Proof Of Concept

!/usr/bin/python Exploit Title : MessengerScan v1.05 Hostname/IP Field SEH/EIP Overwrite POC Discovery by : Anurag Srivastava Email : [email protected] Discovery Date : 18/08/2017 Software Link : https://www.mcafee.com/in/downloads/free-tools/messengerscan.aspx Tested Version :...

Joomla Ultimate Property Listing 1.0.2 SQL Injection

Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/ultimate-property-listing/ Demo: http://demoupl.faboba.com/ Version:...

CVE-2017-12199

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...

CVE-2017-12200

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...

CVE-2017-12199

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...

Design/Logic Flaw

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...

CVE-2017-12199

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...

CVE-2017-12199

The CVE-2017-12199 entry documents a SQL injection in the WordPress plugin Etoile Ultimate Product Catalog (version 4.2.11). The vulnerability arises via multiple wp-admin/admin-ajax.php POST actions (catalogue_update_order, list-item, video_update_order, image_update_order, tag_group_update_orde...

CVE-2017-12200

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...

CVE-2017-12200

The CVE-2017-12200 entry concerns the WordPress plugin Etoile Ultimate Product Catalog (version 4.2.11). A cross-site scripting (XSS) vulnerability exists in the Add Product Manually component, enabling a remote attacker to inject arbitrary web script or HTML. Details across sources confirm the a...

Joomla! Component Ultimate Property Listing 1.0.2 - SQL Injection

Joomla! Component Ultimate Property Listing 1.0.2 - SQL Injection Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software:...

Joomla Ultimate Property Listing 1.0.2 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software:...

Joomla! Component Ultimate Property Listing 1.0.2 - SQL Injection

Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/ultimate-property-listing/ Demo: http://demoupl.faboba.com/ Version:...

WordPress Ultimate Affiliate Pro Plugin Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Ultimate Affiliate Pro plugin. An attacker can exploit this...

WordPress Ultimate Affiliate Pro plugin <=3.6 - Authenticated Stored Cross-site scripting (XSS) vulnerability

Authenticated Stored Cross-site scripting XSS vulnerability found by 8bitsec in premium WordPress Ultimate Affiliate Pro plugin version 3.6 and earlier versions. Cross-site scripting possible when logged in as an affiliate. Solution 2017.07.29 - We were unable to find information about patched...

WordPress Ultimate Affiliate Pro 3.6 Cross Site Scripting

Exploit Title: Ultimate Affiliate Pro WordPress Plugin Edit Account. Write the payload in the 'Last Name' input area: jaVasCript:/-///'/"/// /oNMouseoVer=alertdocument.domain Other fields may be vulnerable. Authenticated Stored XSS: Logged as an affiliate, a low privileged user. Marketing...

WordPress Shortcodes Ultimate Plugin Authenticated Directory Traversal (CVE-2017-2245)

A directory traversal vulnerability exists in WordPress Shortcodes Ultimate Plugin. An authenticated user with admin privileges could exploit this vulnerability by sending specially crafted requests. Successful exploitation may result in an information disclosure...