1348 matches found
dalbum 144 build 174 and earlier CSRF Vulnerabilities
No description provided by source. dalbum 144 build 174 and earlier CSRF Vulnerabilities =================================================================================== Exploit Title:dalbum 144174 and earlier CSRF Vulnerabilities Vendor: http://www.dalbum.org/ Download link...
Early Impact ProductCart 2.6/2.7 modCustomCardPaymentOpt.asp idc Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/13881/info ProductCart is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...
ChurchInfo <= 1.2.12 SQL Injection Vulnerability
No description provided by source. :::::::-. ... ::::::. :::. ;;, ';, ;; ;;;;;;;, ;;; ' . ' $$, $$$$ $$$ $$$ Y$c$$ 888,o8P'88 .d888 888 Y88 MMMMP YmmMMMM MMM YM Discovered by dun \ posdubatgmail.com 2011-01-01 ChurchInfo = 1.2.12 SQL Injection Vulnerability Script: ChurchInfo is a free church...
Vanilla 1.1.4 HTML Injection and Cross-Site Scripting Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/30748/info Vanilla is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...
CommonSense CMS SQL Injection Vulnerability
No description provided by source. Exploit Title: CommonSense CMS Sql Injection Vulnerability Author: Pokeng Software Link: http://www.sensesites.com/ Platform / Tested on: Win/Linux category: webapps/0day Code : http://site/article.php?articleid=SQL Dork : Powered by CommonSense CMS Greetz Explo...
Pixie CMS 1.01 - 1.04 - Blind SQL Injections
No description provided by source. Exploit Title: Pixie CMS 1.01 - 1.04 pixieuser Blind SQL Injection Google Dork: None Date: 11/14/2011 Author: Piranha, piranhaattorontomail.com Software Link: http://www.getpixie.co.uk/ Version: 1.01 - 1.04 Tested on: Windows XP SP3, Pixie versions: 1.01 - 1.04...
Dragon Internet Events Listing 2.0.01 venue_detail.asp VenueID Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/21098/info Dragon Event Listing is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow a...
360 Web Manager 3.0 - Multiple Vulnerabilities
No description provided by source. Exploit Title: Multiple vulnerabilities in 360 Web Manager 3.0 Google Dork: Powered by 360 Web Manager 3.0 Date: 15/04/2011 Author: Ignacio Garrido Contact: [email protected] Software Link: www.360webmanager.com Version: v3.0 Tested on: Linux 2.6.18 Vulnerabilit...
EVA-Web 2.1.2 article-album.php3 debut_image Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/18161/info EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...
OWASP Mantra Security Toolkit - Browser Based Security Framework
OWASP Mantra is a collection of free and open source tools integrated into a web browser, which can become handy for students, penetration testers, web application developers,security professionals etc. It is portable, ready-to-run, compact and follows the true spirit of free and open source...
PHPOK SQL注射漏洞（官网）
简要描述： 参数过滤不严导致sql注入 详细说明： 测试官网OK http://www.phpok.com/api.php?c=api&f=phpok&id=sublist¶mpid=1%20union%20select%20VERSION,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33%20union%20select%20%20from%20qingganproject%20where%200 漏洞证明：...
w3af - Open Source Web Application Security Scanner
w3af , is a Web Application Attack and Audit Framework. The w3af core and it’s plugins are fully written in python, it identifies more than 200 vulnerabilities and reduce your site’s overall risk exposure. Identify vulnerabilities like SQL Injection, Cross-Site Scripting, Guessable credentials,...
CVE-2013-6454
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute...
Acunetix Web Vulnerability Scanner Version 9 - Web Application Security Testing Tool
Acunetix W eb V ulnerability S canner WVS is an automated web application security testing tool that audits your web applications by checking for exploitable hacking vulnerabilities. Automated scans may be supplemented and cross-checked with the variety of manual tools to allow for comprehensive...
Use of the referrer header on the error page for Crucible can enable XSS attacks
If the referrer header is manipulated and an error condition is triggered, the user will be displayed the error page in FeCru, which includes the manipulated referrer value on the page as a link. The use of the referrer header value directly as the target of a hyperlink can result in the user...
Burp Suite Professional v1.6 - The leading toolkit for web application security testing
Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application’s attack surface, through to finding and exploiting security...
OWASP ZAP 2.3.0.1 - An easy to use integrated penetration testing tool for finding vulnerabilities in web applications
The OWASP Zed Attack Proxy ZAP is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications. It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration...
Sophos Web Protection Appliance Command Execution
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution', 'Description' = %q This module takes advantage ...
Khan Academy: CSRF - Adding/Removing items to cart - shop.khanacademy.org
Hi there, I've discovered a possiblity to remove/add items to a users' cart at shop.khanacademy.org. Details - Host: shop.khanacademy.org - URL: http://shop.khanacademy.org/cart - Affected parameters: updatesPRODUCTID Steps to reproduce - 1. Visit http://shop.khanacademy.org/cart and empty your...
[Skipfish] Web Application Security Scanner
Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active but hopefully non-disruptive...