Dokeos LMS <= 1.8.5 (include) Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl Dokeos LMS = 1.8.5 include Remote Code Execution Exploit Description --------------------------------------------------------------- Dokeos LMS contains one flaw that allows an attacker to include a local file with html extension. The issue is due...

Ppim <= 1.0 (Arbitrary File Delete/XSS) Multiple Vulnerabilities

No description provided by source. Author : BeyazKurt Contact : [email protected] Script : Ppim v1.0 Bu ne bicim script adidir amk :D Download : http://scripts.ringsworld.com/organizers/ppim.zip D0rk : inurl:events.php?listallevents File Delete Vulnerability: upload.php...

FreeWPS 2.11 Upload.PHP Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20494/info FreeWPS is prone to a remote command-execution vulnerability. Attackers can exploit this issue to execute arbitrary system commands with the privileges of the webserver process. FreeWPS version 2.11 is vulnerab...

WordPress dzs-videogallery Plugins Remote File Upload Vulnerability

No description provided by source. Exploit Title: WordPress dzs-videogallery Plugins Remote File Upload Vulnerability Author: iskorpitx Date: 22/11/2013 Vendor Homepage: http://digitalzoomstudio.net Themes Link: http://digitalzoomstudio.net/docs/wpvideogallery/ Infected File: upload.php Category:...

Wordpress Relocate Upload Plugin 0.14 Remote File Inclusion

在relocate-upload.php文件第16行,没有对传入的abspath进行过滤,导致任意文件本地远程文件包含 if isset$GET'rufolder' // WP setup and function access define'WPUSETHEMES', false; requireonceurldecode$GET'abspath'.'/wp-load.php'; // save us looking for it, it's passed as a GET parameterarameter...

Barbo91 'upload.php' Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/37512/info Barbo91 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an...

contentnow 1.30 (upload/xss) Multiple Vulnerabilities

No description provided by source. ContentNow Directory Traversalupload.php ------------------------------------------ -vulnerability By: Timq -http://securitydb.org -Team Root-Shell -Email:timqathushmail.com ------------------------------------------ It appears that it is possible to view any...

NetLink Arbitrary File Upload Vulnerability

No description provided by source. ====================================== NetLink Remote Arbitrary File Upload Vulnerability Download: http://sourceforge.net/projects/kp-netlink/ by lumut-- Homepage: lumutcherenza.biz ====================================== upload.php ?php extract$POST; if $submit...

Velhost Uploader Script 1.2 - Local File Inclusion Vulnerability

No description provided by source. =============================================================== velhost uploader script v1.2 Local File Inclusion Vulnerability =============================================================== + velhost uploader script v1.2 Local File Inclusion Vulnerability...

Battle Scrypt Shell Upload Vulnerability

No description provided by source. Exploit Title: Battle Scrypt Shell Upload Vulnerability Date: 19.05.2010 Author: DigitALL Software Link: http://www.scrypted.com/battlescrypt.html Tested on: Windows Xp Sp3 Code : d0rk: Powered by Battle Scrypt or inurl:upload.php For Script Kidde : Exploit: Go ...

WordPress OptimizePress Theme File Upload Remote Code Execution

A file upload vulnerability has been reported in the Wordpress theme OptimizePress. The vulnerability is due to an insecure file upload on the media-upload.php component. A remote attacker could trigger this flaw by sending a crafted HTTP request to the vulnerable system...

NS_ASG 6.3 /upload.php 任意文件上传漏洞

No description provided by source...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in eXtplorer 2.1.3, when used as a component for Joomla!, allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 application.js.php in scripts/ or 2 admin.php, 3 copymove.php, 4 functions.php, 5 header.php, or 6...

CVE-2013-5951

Multiple cross-site scripting XSS vulnerabilities in eXtplorer 2.1.3, when used as a component for Joomla!, allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to 1 application.js.php in scripts/ or 2 admin.php, 3 copymove.php, 4 functions.php, 5 header.php, or 6...

CVE-2013-5952: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Freichat comfreichat component, possibly 9.4 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 id or 2 xhash parameter to client/chat.php or 3 toname parameter to client/plugins/upload/upload.p...

Debian: Security Advisory (DSA-2882-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Joomla Freichat Cross Site Scripting

Hello, Multiple cross-site scripting XSS vulnerabilities in Freichat component for Joomla! allow remote attackers to inject arbitrary web script or HTML code via 1 the id or xhash parameters to /client/chat.php or 2 the toname parameter to /client/plugins/upload/upload.php. File: /client/chat.php...

WordPress < 3.3.3 / 3.4.0 Multiple Vulnerabilities

According to its version number, the WordPress install hosted on the remote web server is affected by the following vulnerabilities : - A cross-site scripting flaw exists in the 'edit-tags.php' script where it does not validate the 'slug' parameter upon submission. This could allow a remote...

CVE-2012-6634: Undefined Security Weakness

wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a postid value...

CVE-2012-6621: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Email Address or 2 Custom Permalink Structure fields in admin/settings.php; 3 path parameter to admin/upload.php; 4 err paramet...