Simple Forum PHP 2.4 Cross Site Scripting

===================================================== Simple Forum PHP 2.4 - Reflected XSS ===================================================== Vendor Homepage: http://simpleforumphp.com Date: 14 Oct 2016 Demo Link : http://simpleforumphp.com/forum/admin.php Version : 2.4 Platform : WebApp - PHP...

Simple Forum PHP 2.4 - SQL Injection

Simple Forum PHP 2.4 - SQL Injection ===================================================== Simple Forum PHP 2.4 - SQL Injection ===================================================== Vendor Homepage: http://simpleforumphp.com Date: 14 Oct 2016 Demo Link : http://simpleforumphp.com/forum/admin.php...

Colorful Blog - Persistent Cross-Site Scripting

Colorful Blog - Persistent Cross-Site Scripting Exploit Title : ----------- : Colorful Blog - Stored Cross Site Scripting Author : ----------------- : Besim Google Dork : --------- : - Date : -------------------- : 13/10/2016 Type : -------------------- : webapps Platform : --------------- : PHP...

WordPress Newsletter 4.6.0 Cross Site Request Forgery / Cross Site Scripting

Hello, Wordpress Plugin: Newsletter 4.6.0 https://wordpress.org/plugins/newsletter/ is vulnerable to CSRF and XSS. The issue is supposed to be fixed in version 4.6.1 . See https://wordpress.org/plugins/newsletter/changelog/ for more details. 1. Stored Cross-Site Scripting XSS Authenticated...

ApPHP MicroCMS 3.9.5 - Persistent Cross-Site Scripting

ApPHP MicroCMS 3.9.5 - Persistent Cross-Site Scripting Exploit Title :----------------- : ApPHP MicroCMS 3.9.5 - Stored Cross Site Scripting Author :------------------------ : Besim Google Dork :---------------- : - Date :-------------------------- : 12/10/2016 Type :-------------------------- :...

BuilderEngine 3.5.0 - Arbitrary File Upload

Exploit for php platform in category web applications 0day.today 2018-04-14...

Slack: Stored XSS(Cross Site Scripting) In Slack App Name

Hello Slack, This vulnerability is about a Stored Cross Site Scripting Slack Stored XSS In AppApp Name Vulnerable URLEdit App Page https://api.slack.com/apps/appid/general https://api.slack.com/apps/A21B3V9GA/general Vulnerable Parameter = name Note -Its also work on other user as well. Send this...

Shopify: (BYPASS) Open redirect and XSS in supporthiring.shopify.com

Hello, The users can be redirected to some other site which is in control of the attacker from Vulnerable parameter: path= You have a protection here at path= but it bypass the parameter if you add a double slash, like %2F%2F. Let's say user is attacker asked victim to came to this page: :...

Joomla BT Media 1.0 SQL Injection

Exploit Title : Joomla combtmedia - SQL Injection Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/bt-media-gallery Category: Webapps Tested on: Win Version: 1.0 Date: 2016/06/19 PoC: categories0= Parameter Vulnerable To SQL Demo :...

Apache Continuum 1.4.2 - Multiple Vulnerabilities

Exploit Title: Unauthenticated command injection - Apache Continuum Google Dork: inurl::8080/continuum/ Date: 04/06/2016 Exploit Author: David Shanahan @cyberpunksec Contact: http://www.procheckup.com/ Vendor Homepage: https://continuum.apache.org/ Software Link:...

ManageEngine SelfService Plus Cross Site Scripting

Exploit Title: Reflected XSS in ManageEngine SelfService Plus - 0day - Confirmed Google Dork: N/A Date: 29/5/2016 Exploit Author: Mohamed Saeed Contact: http://twitter.com/krmalab Website: http://www.dts-solution.com Vendor Homepage: https://www.manageengine.com/ Software Link:...

VMWare vSphere Web Client 6.0 Cross Site Scripting

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/VMWARE-VSPHERE-FLASH-XSS.txt + ISR: apparitionsec Vendor: =============== www.vmware.com Product: ==================================== VMWare vSphere Web Client v5.1 - 6.0 A...

Web2py 2.14.5 - Multiple Vulnerabilities

Web2py 2.14.5 - Multiple Vulnerabilities Title - Web2py 2.14.5 Multiple Vulnerabilities LFI,XSS,CSRF Exploit Title : Web2py 2.14.5 Multiple Vulnerabilities LFI, XSS,CSRF Reported Date : 2-April-2016 Fixed Date : 4-April-2016 Exploit Author : Narendra Bhati -...

WAP Music CMS 1.0.2 SQL Injection

========================================================== + Title :- WAP MUSIC CMS - SQL INJECTION + Date :- 24 - MAR - 2016 + Vendor Homepage :- www.wapforum.org + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks :-...

SM Soft Tech CMS 1.0 SQL Injection

========================================================== + Title :- SM SOFT TECH CMS - SQL INJECTION + Date :- 24 - MAR - 2016 + Vendor Homepage :- http://www.smsofttech.net/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks :...

New Relic: Reflected XSS on Signup Page

Hello Team, I have found a reflected XSS on Signup Page i.e. on https://newrelic.com/signup. Please find the below details. Vulnerable URL: https://newrelic.com/signup Vulnerable Field: Your Email Address Vulnerable Parameter: email Parameter Type: POST Payload used: Browser used: Mozilla Firefox...

WordPress Newsletter Pro 2.5.3.3 Open Redirect

^^^^^^^^^^^ ^ Exploit Title : Wordpress Newsletter Pro Plugin Open Redirect ^ Exploit Author : Ashiyane Digital Security Team ^ Vendor Homepage: http://www.thenewsletterplugin.com/downloads ^ Google Dork : inurl:newsletter-pro/do.php ^ Date : 06 Feb. 2016 ^ Tested On : Win 10 | CyberFox Browser &...

File Manager PRO v1.3 iOS - Multiple Web Vulnerabilities

Document Title: =============== File Manager PRO v1.3 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1704 Release Date: ============= 2016-02-03 Vulnerability Laboratory ID VL-ID: ====================================...

WordPress Tubepress 2 Cross Site Scripting

^^^^^^^^^^^ ^ Exploit Title : Wordpress Tubepress Plugin v 2 Cross Site Scripting ^ Exploit Author : Ashiyane Digital Security Team ^ Vendor Homepage : https://wordpress.org/plugins/tubepress/ ^ Date: 13 Jan 2016 ^ Tested On : Win 10 | CyberFox Browser & Kali Linux | IceWeasel ^ ^^^^^^^^^^^ ^...

PHP Melody CMS 2.3 SQL Injection

================================================================================ PHP Melody CMS v2.3 SQL injection ================================================================================ Vendor Homepage: https://www.phpsugar.com Date: 26/12/2015 Script Link:...