Magic Deals Web by Jason Web Design,1.2.0,SQL Injection

Magic Deals Web by Jason Web Design, 1.2.0, SQL Injection...

CVE-2017-6544

Gargaj/wuhu through 2017-03-08 is vulnerable to a reflected XSS in wuhu-master/wwwadmin/users.php id parameter...

CVE-2017-2682

CVE-2017-2682 concerns Siemens RUGGEDCOM NMS web application CSRF vulnerability. The issue affects RUGGEDCOM NMS versions prior to V2.1.0 and involves the web interface on ports 8080/TCP and 8081/TCP, where a remote attacker could induce an authenticated user to perform administrative operations ...

CVE-2016-5801

CVE-2016-5801 affects OmniMetrix OmniView (Version 1.2). Root cause: weak password requirements allow brute-forcing credentials over HTTP, enabling remote access. Impact per sources: credential compromise could enable control of associated backup generators. Mitigation details in public documents...

LocalTapiola: SQL Injection on /webApp/lapsuudenturva (viestinta.lahitapiola.fi)

Issue The reporter found a blind SQL Injection attack in an application in viestinta.lahitapiola.fi. Fix The issue was investigated and found to be valid. The fix was to remove the application as it was not needed. Reasoning The reported case was valid and within the scope of the bug bounty...

Critical Updates — RCE Flaws Found in SwiftMailer, PhpMailer and ZendMail

A security researcher recently reported a critical vulnerability in one of the most popular open source PHP libraries used to send emails that allowed a remote attacker to execute arbitrary code in the context of the web server and compromise a web application. Disclosed by Polish security...

EasyNetSites 'links.php' Page SQL Injection Vulnerability

EasyNetSites is a WEB-based tool for managing organizational relationships on websites. A SQL injection vulnerability exists in the cid parameter of the links.php page of EasyNetSites, which originates from the program's failure to adequately filter user-submitted input, and can be exploited by a...

Burp Suite Professional 1.7.14 - The Leading Toolkit for Web Application Security Testing

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security...

CVE-2016-6851

CVE-2016-6851 (Open-Xchange OX Guard) vulnerability in Open-Xchange OX Guard before 2.4.2-rev5 allows cross-site scripting via the guest reader web application without authentication. Malicious script can execute in a user’s context, potentially causing session hijacking or triggering actions (e....

AbanteCart 1.2.7 Cross Site Scripting

Exploit Title: AbanteCart 1.2.7 Stored XSS Date: 06-12-2016 Software Link: http://www.abantecart.com/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description By default all user input is escaped using...

AbanteCart 1.2.7 - Cross-Site Scripting

AbanteCart 1.2.7 - Cross-Site Scripting Exploit Title: AbanteCart 1.2.7 Stored XSS Date: 06-12-2016 Software Link: http://www.abantecart.com/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description By default all...

WordPress Single Personal Message 1.0.3 SQL Injection

Exploit Title: Single Personal Message 1.0.3 a Plugin WordPress a Sql Injection Date: 28/11/2016 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/simple-personal-message/ Software Link: https://wordpress.org/plugins/simple-personal-message/ Contact:...

The React application in the most common XSS exploits and Defense-vulnerability warning-the black bar safety net

The author has been firmly React technology stack of the user, and therefore will pay attention to the React application security related topics. The author in my ownReact+Redux+Webpack2scaffolding the third level also uses a lot of server-side rendering/isomorphism straight out of the technology...

Acunetix v11 - Web Application Security Testing Tool

London, UK – November 2016 – Acunetix, the pioneer in automated web application security software, has announced the release of version 11. New integrated vulnerability management features extend the enterprise’s ability to comprehensively manage, prioritise and control vulnerability threats –...

Informatica: [marketplace.informatica.com] Persistent XSS through document title

Document titles are not properly escaped before being printed on https://marketplace.informatica.com/docs/ . By including a payload in a document title, an attacker can create a document with a persistent XSS vector which executes for anyone viewing the document page. Proof of concept === The...

CNDSOFT 2.3 - Cross-Site Request Forgery Arbitrary File Upload

CNDSOFT 2.3 - Cross-Site Request Forgery Arbitrary File Upload ========================================================================================================= Exploit Title: CNDSOFT 2.3 - Arbitrary File Upload with CSRF shell.php Author: Besim Google Dork: - Date: 19/10/2016 Type: webap...

yawast - The YAWAST Antecedent Web Application Security Toolkit

YAWAST is an application meant to simplify initial analysis and information gathering for penetration testers and security auditors. It performs basic checks in these categories: TLS/SSL - Versions and cipher suites supported; common issues. Information Disclosure - Checks for common information...

Colorful Blog Cross Site Scripting

Exploit Title : ----------- : Colorful Blog - Stored Cross Site Scripting Author : ----------------- : Besim Google Dork : --------- : - Date : -------------------- : 13/10/2016 Type : -------------------- : webapps Platform : --------------- : PHP Vendor Homepage :-- : - Software link : --------...

Colorful Blog - Cross-Site Request Forgery (Change Admin Password)

Exploit Title :----------- : Colorful Blog - Cross-Site Request Forgery Change Admin Pass Author :------------------ : Besim Google Dork :---------- : - Date :--------------------- : 13/10/2016 Type :--------------------- : webapps Platform :---------------- : PHP Vendor Homepage :-- : - Software...

Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)

Exploit Title : Maian Weblog 4.0 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : - Date : 10/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.maianweblog.com Software link : http://www.hotscripts.com/listings/jump/download/21864 CSRF PoC " /...