acheiimobiliaria.com XSS vulnerability

Open Bug Bounty ID: OBB-635350 Description| Value ---|--- Affected Website:| acheiimobiliaria.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GDPR Is Here: Web App Security Is a Must

With web and mobile apps becoming a preferred vector for data breaches, organizations must include application security in their plans for complying with the EU’s General Data Protection Regulation GDPR. GDPR went into effect in May, imposing strict requirements on millions of businesses worldwid...

Joomla! Component EkRishta 2.10 - username SQL Injection

Joomla! Component EkRishta 2.10 - username SQL Injection Exploit Title: Joomla! Component EkRishta 2.10 - 'username' SQL Injection Date: 2018-06-11 Exploit Author: L0RD Software Link: https://extensions.joomla.org/extension/ek-rishta/ Vendor Homepage: https://www.joomlaextensions.co.in/ Version:...

velostreet.com XSS vulnerability

Open Bug Bounty ID: OBB-630127 Description| Value ---|--- Affected Website:| velostreet.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PHP Dashboards NEW 5.5 - email SQL Injection

PHP Dashboards NEW 5.5 - email SQL Injection Exploit Title: PHP Dashboards NEW v5.5 - 'Login' SQL Injection Dork: N/A Date: 31.05.2018 Exploit Author: Kağan Çapar Contact: [email protected] Vendor Homepage: https://codecanyon.net/item/php-dashboards-v50-brand-new-enterprise-edition/21540104...

MySQL Blob Uploader 1.7 Cross Site Scripting / SQL Injection

------------------------- Exploit 1 of 4: Exploit Title: MySQL Blob Uploader 1.7 - 'download.php' SQL Injection / Cross-Site Scripting Dork: N/A Date: 22.05.2018 Exploit Author: Azkan Mustafa AkkuA AkkuS Vendor Homepage:...

Web Application Penetration Testing Tool: Tracy

Tracy is a pentesting tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner. tracy should be used during the mapping-the-application phase of the pentest to identify sources of input and their corresponding outputs. tracy...

Outpost24 OUTSCAN for detecting vulnerabilities on your network perimeter

Today I would like to write a post about Outpost24. This company was founded in 2001. For comparison, Tenable was founded in 2002 and Qualys in 1999. So, it's a company with a pretty long history. Outpost24 make Vulnerability Management & Web Application Security products and provide various...

CVE-2017-18262

CVE-2017-18262 affects Blackboard Learn; unvalidated redirects exist via the Shibboleth login flow. The vulnerable endpoint is BLACKBOARD/webapps/bb-auth-provider-shibboleth-BBLEARN/execute/shibbolethLogin?returnUrl=, which can redirect signed-in users to an arbitrary URL. Connected sources corro...

people.cs.kuleuven.be XSS vulnerability

Open Bug Bounty ID: OBB-607450 Description| Value ---|--- Affected Website:| people.cs.kuleuven.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-10285

The Ericsson-LG iPECS NMS A.1Ac web application uses incorrect access control mechanisms. Since the app does not use any sort of session ID, an attacker might bypass authentication...

Thinkphp3.2.3最新版update注入漏洞

原文来自安全客，作者：0r3ak@0kee Team 原文： 简要描述 thinkphp是国内著名的php开发框架，有完善的开发文档，基于MVC架构，其中Thinkphp3.2.3是目前使用最广泛的thinkphp版本，虽然已经停止新功能的开发，但是普及度高于新出的thinkphp5系列，由于框架实现安全数据库过程中在update更新数据的过程中存在SQL语句的拼接，并且当传入数组未过滤时导致出现了SQL注入。 Git补丁更新 新增加了BIND表达式 漏洞详情...

WooCommerce CSV-Importer-Plugin 3.3.6 Remote Code Execution

Exploit Title: Plugin Woocommerce CSV importer 3.3.6 a RCE a Unlink Date: 08/04/2018 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/woocommerce-csvimport/ Software Link: https://wordpress.org/plugins/woocommerce-csvimport/ Contact: http://twitter.com/lenonleite Website...

osCommerce 2.3.4.1 - Remote Code Execution

Exploit Title: osCommerce 2.3.4.1 Remote Code Execution Date: 29.0.3.2018 Exploit Author: Simon Scannell - https://scannell-infosec.net Version: 2.3.4.1, 2.3.4 - Other versions have not been tested but are likely to be vulnerable Tested on: Linux, Windows If an Admin has not removed the /install/...

ara.ac.nz XSS vulnerability

Open Bug Bounty ID: OBB-582548 Description| Value ---|--- Affected Website:| ara.ac.nz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

bcodental.nl XSS vulnerability

Open Bug Bounty ID: OBB-578696 Description| Value ---|--- Affected Website:| bcodental.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

WAScan - Web Application Scanner

WAScan Web Application Scanner is a Open Source web application security scanner. It is designed to find various vulnerabilities using "black-box" method, that means it won't study the source code of web applications but will work like a fuzzer, scanning the pages of the deployed web application,...

Joomla! Component Ek Rishta 2.9 - SQL Injection

Joomla! Component Ek Rishta 2.9 - SQL Injection Exploit Title: Joomla! Component Ek Rishta 2.9 - SQL Injection Dork: N/A Date: 22.02.2018 Vendor Homepage: https://www.joomlaextensions.co.in/ Software Link: https://extensions.joomla.org/extensions/extension/living/dating-a-relationships/ek-rishta/...

Twig Server Side Template Injection

Vulnerability details: Exploit Title: Twig Output: 16 2. POC: http://localhost/search?searchkey=44 OUTPUT: 4 http://localhost/search?searchkey=ls OUTPUT: list of files/directories etca|...

Multi religion Responsive Matrimonial 4.7.2 - Cross-Site Scripting

Multi religion Responsive Matrimonial 4.7.2 - Cross-Site Scripting. CVE-2018-6864. Webapps exploit for PHP platform Exploit Title: Multi religion Responsive Matrimonial - 4.7.2 - Stored XSS Date: 07.02.2018 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link:...