MultiPowUpload 2.1 Shell Upload

Exploit Title: MultiPowUpload v 2.1 Remote File Upload Vulnerability Author: DIES3L Email: [email protected] Date: 26-1-2011 Software Link: http://www.element-it.com Download Software : http://www.element-it.com/Download/ElementIT.MultiPowUpload3.zip Version: 2.1 Tested on: LiNuX...

SOOP Portal 2.0 - Arbitrary File Upload

SOOP Portal 2.0 - Arbitrary File Upload I N F O Exploit Title: SOOP Portal 2.0 Remote Upload Shell Vulnerability DDate: 05-12-2010 Author: Net.Edit0r Software Link: www.soopportal.com Version: 2.0 Tested on: windows server 2008 Contact: [email protected] [email protected] E X P L O I T 1...

Krojac CMS SQL Injection

Exploit Title: Krojach CMS SQL Injection Vulnerabilities Date found: 6.2010 Author: MikiSoft Email: [email protected] CMS Software Site/Link: http://www.krojac.com Versions affected: All Edit: In latest version this is fixed now... Google dorks: intext:"Skrojio i sašio Krojač" ; intext:"Made...

Design/Logic Flaw

Google Hack Honeypot GHH File Upload Manager 1.3 allows remote attackers to delete uploaded files via unknown vectors related to the delall action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. CVE analysis suggests...

CVE-2008-5283

The CVE concerns Google Hack Honeypot (GHH) File Upload Manager 1.3. The vulnerability enables remote attackers to delete uploaded files via unknown vectors related to the delall action to index.php. This is stated in multiple sources, though the exact exploit vectors are not disclosed in the pro...

CVE-2008-5026

Microsoft SharePoint uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files aka attachments, which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting XSS attacks by uploading HTML...

Debian DSA-1488-1 : phpbb2 - several vulnerabilities

Several remote vulnerabilities have been discovered in phpBB, a web-based bulletin board. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2008-0471 Private messaging allowed cross site request forgery, making it possible to delete all private messages of...

Cross site scripting

Unspecified vulnerability in Mahara before 0.9.1 has unknown impact and remote attack vectors, probably related to cross-site scripting XSS in uploaded files...

CVE-2008-0381

Technical details for CVE-2008-0381 are not publicly available in the provided documents. No concrete affected versions, root cause, or fixes are specified beyond generic cross-site scripting in uploaded Mahara files. Monitor for updates.

CVE-2008-0381

Unspecified vulnerability in Mahara before 0.9.1 has unknown impact and remote attack vectors, probably related to cross-site scripting XSS in uploaded files...

Design/Logic Flaw

Zomplog 3.8.1 and earlier stores potentially sensitive information under the web root with insufficient access control, which allows remote attackers to download files that were uploaded by users, as demonstrated by obtaining a directory listing via a direct request to /upload and then retrieving...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via 1 the who parameter to showuser; and other vectors involving 2 calendar mode, 3 bulletin board mode, 4 room names, and 5 uploaded file names...

CVE-2007-3822

Multiple cross-site scripting XSS vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via 1 the who parameter to showuser; and other vectors involving 2 calendar mode, 3 bulletin board mode, 4 room names, and 5 uploaded file names...

CVE-2006-6999

attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified id parameter...

CVE-2006-6999

attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified id parameter...

CVE-2006-4576

Cross-site scripting XSS vulnerability in The Address Book 1.04e allows remote attackers to inject arbitrary web script or HTML by uploading the HTML file with a GIF or JPG extension, which is rendered by Internet Explorer...

Vulnerability in Btitracker

Hello, I found a vulnerability in btitracker a tool for create a bittorrent tracker written in php…. This vulnerability can remove physically uploaded files .torrent video : http://aeroxteam.free.fr/btitracker.html exploitnot to diffuse : form...

FreeBSD : tikiwiki -- multiple vulnerabilities (e4c62abd-5065-11db-a5ae-00508d6a62df)

Secunia reports : Thomas Pollet has discovered a vulnerability in TikiWiki, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the 'highlight' parameter in tiki-searchindex.php is not properly sanitised before being returned to the user. This can b...

CVE-2006-4935

The Database module in Moodle before 1.6.2 does not properly handle uploaded files, which has unspecified impact and remote attack vectors...

tikiwiki -- multiple vulnerabilities

Secunia reports: Thomas Pollet has discovered a vulnerability in TikiWiki, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed to the "highlight" parameter in tiki-searchindex.php is not properly sanitised before being returned to the user. This can be...