Online Health Care System 1.0 Cross Site Scripting

Exploit Title: Online Health Care System 1.0 - Multiple Cross Site Scripting Stored Google Dork: N/A Date: 2020/10/24 Exploit Author: Akıner Kısa Vendor Homepage: https://www.sourcecodester.com/php/14526/online-health-care-system-php-full-source-code-2020.html Software Link:...

Loan Management System 1.0 Cross Site Scripting

Exploit Title: Loan Management System 1.0 - Multiple Cross Site Scripting Stored Google Dork: N/A Date: 2020/10/19 Exploit Author: Akıner Kısa Vendor Homepage: https://www.sourcecodester.com/php/14471/loan-management-system-using-phpmysql-source-code.html Software Link:...

Loan Management System 1.0 - Multiple Cross Site Scripting (Stored)

Exploit Title: Loan Management System 1.0 - Multiple Cross Site Scripting Stored Google Dork: N/A Date: 2020/10/19 Exploit Author: Akıner Kısa Vendor Homepage: https://www.sourcecodester.com/php/14471/loan-management-system-using-phpmysql-source-code.html Software Link:...

Webtareas 2.1 / 2.1p Cross Site Scripting

Author: AppleBois Homepage: https://sourceforge.net/projects/webtareas/ Affected Version: 2.1/2.1p Stored XSS Allows an attacker to execute arbitrary HTML and JavaScript code More info : https://medium.com/@tehwinsam/webtareas-2-1-c8b406c68c2a Solutions: "NONE" Payload = alert‘AppleBois’;...

Shanghai Danfan Network Technology Co., Ltd. station building system ab**.php, se**.php and other pages exist SQL injection vulnerability

Shanghai Danfan network science and technology limited company builds the station system is for the chemical industry to provide the security, the high efficiency, the multi-function, the system matching B2B electronic commerce platform specialized website. Shanghai Danfan network science and...

TestLink 1.9.19 Cross Site Scripting

Exploit Title: TestLink 1.9.19 - Persistent Cross-Site Scripting Date: 2019-11-20 Exploit Author: Milad Khoshdel Software Link: http://testlink.org/ Version: TestLink 1.9.19 Tested on: Linux Apache/2 PHP/7.3.11 ========= Vulnerable Pages: ========= Persistent --...

TestLink 1.9.19 - Persistent Cross-Site Scripting

Exploit Title: TestLink 1.9.19 - Persistent Cross-Site Scripting Date: 2019-11-20 Exploit Author: Milad Khoshdel Software Link: http://testlink.org/ Version: TestLink 1.9.19 Tested on: Linux Apache/2 PHP/7.3.11 ========= Vulnerable Pages: ========= Persistent --...

MyBB Visual Editor 1.8.18 - Cross-Site Scripting

Title: MyBB Visual Editor 1.8.18 - Cross-Site Scripting Author: Numan OZDEMIR Vendor Homepage: mybb.com Software Link: https://mybb.com/download/ Version: Up to v1.8.18. Fixed in v1.8.19. PoC Video: https://numanozdemir.com/mybb/xss.mp4 CVE: CVE-2018-17128 Description: Attacker can run JavaScript...

Netsweeper 4.0.4 - SQL Injection

Netsweeper 4.0.4 - SQL Injection +----------------------------------+ + Netsweeper 4.0.4 - SQL Injection + +----------------------------------+ Affected Product: Netsweeper Vendor Homepage : www.netsweeper.com Version : 4.0.4 and probably other versions Discovered by : Anastasios Monachos secuid0...

Apache-mod_cgi-Shellshock

Shellshock apache modcgi remote exploit rhost: victim host rport: victim port for TCP shell binding lhost: attacker host for TCP shell reversing lport: attacker port for TCP shell reversing pages: specific cgi vulnerable pages separated by comma proxy: host:port proxy ! /usr/bin/env python from...

Apache mod_cgi - Remote Exploit (Shellshock)

No description provided by source. ! /usr/bin/env python from socket import from threading import Thread import thread, time, httplib, urllib, sys stop = False proxyhost = "" proxyport = 0 def usage: print """ Shellshock apache modcgi remote exploit Usage: ./exploit.py var=value Vars: rhost: vict...

Apache mod_cgi - 'Shellshock' Remote Command Injection

!/usr/bin/env python from socket import from threading import Thread import thread, time, httplib, urllib, sys stop = False proxyhost = "" proxyport = 0 def usage: print """ Shellshock apache modcgi remote exploit Usage: ./exploit.py var= Vars: rhost: victim host rport: victim port for TCP shell...

Nokia : Exploiting cross-site scripting in Referer header in Trade.online.nokia.com

Little Insight: The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks or referer page back link . The payload Referer: javascript:prompt1; was submitted in the Referer HTTP header. This input was store on page back link when user...

Inventory 1.0 Cross Site Scripting

Exploit Title: Inventory 1.0 Multiple XSS Vulnerabilities Date: 10/19/12 Author: G13 Twitter: @g13net Software Site: https://github.com/farevalod/inventory Version: 1.0 Category: webapp php dc585 ToC 0x01 Description 0x02 XSS 0x03 Vendor Notification 0x01 Description PHP + SQL Inventory tracking...

CGI Generic On Site Request Forgery (OSRF)

The remote web server hosts CGI scripts that fail to adequately sanitize request strings with special characters like dots, slashes, backslashes, equal signs, question marks, etc. By leveraging this issue, an attacker may be able to cause arbitrary GET requests to be executed by a user when he...

PHPRunner 4.2 (SearchOption) Blind SQL Injection Vulnerability

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: PHPRunner SQL Injection Vendor: http://www.xlinesoft.com Vulnerable Version: 4.2 prior versions also may be affected Exploitation: Remote with browser Original Advisory: http://www.bugreport.ir/index63.htm...

[USN-735-1] GStreamer Base Plugins vulnerability

www.BugReport.ir AmnPardaz Security Research Team Title: PHPRunner SQL Injection Vendor: http://www.xlinesoft.com Vulnerable Version: 4.2 prior versions also may be affected Exploitation: Remote with browser Original Advisory: http://www.bugreport.ir/index63.htm Fix: N/A - Description: PHPRunner...

PHPRunner 4.2 - SearchOption Blind SQL Injection

PHPRunner 4.2 - SearchOption Blind SQL Injection www.BugReport.ir AmnPardaz Security Research Team Title: PHPRunner SQL Injection Vendor: http://www.xlinesoft.com Vulnerable Version: 4.2 prior versions also may be affected Exploitation: Remote with browser Original Advisory:...

PHPRunner 4.2 SQL Injection

www.BugReport.ir AmnPardaz Security Research Team Title: PHPRunner SQL Injection Vendor: http://www.xlinesoft.com Vulnerable Version: 4.2 prior versions also may be affected Exploitation: Remote with browser Original Advisory: http://www.bugreport.ir/index63.htm Fix: N/A - Description: PHPRunner...

Graugon PHP Article Publisher 1.0 SQL Injection

0x01 Informations: Name : Graugon PHP Article Publisher 1.0 Download : http://www.hotscripts.com/listings/jump/download/88458/ Vulnerability : Multiple Sql Injections / Insecure Cookie Handling Author : x0r Contact : [email protected] Notes : Proud to be Italian 0x02 Bug: Bugged Page: index.ph...