CVE-2019-3474

CVE-2019-3474 describes a path traversal vulnerability in the web application component of Micro Focus Filr 3.x. An attacker authenticated as a low-privilege user can download arbitrary files from the Filr server. The issue affects all Filr 3.x versions prior to Security Update 6. Public exploit ...

Smule: Error Page Content Spoofing or Text Injection

Description: -------------- Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, a...

First look at Tenable.io Web Application Scanner (WAS)

When Tenable firstly announced Web Application Security scanner as a part of their new Tenable.io platform, it was quite intriguing. Certainly, they already had some WAS functionality before in Nessus. For example, path traversal check was pretty good. But this functionality was quite fragmental...

SQL injection vulnerability in the front-end bi***_mo***.asp file of the EcoTimes Enterprise Online Bookkeeping Management System

EcoTimes Enterprise Online Bookkeeping Management System" is an online bookkeeping software, especially suitable for small and medium-sized enterprises, stores, etc. to manage cash flow accounts, accounts receivable and payable accounts, as well as the company's bookkeeping and other related...

Advanced Comment System 1.0 Cross Site Scripting

...

CVE-2019-8933

In DedeCMS 5.7SP2, attackers can upload a .php file to the uploads/ directory without being blocked by the Web Application Firewall, and then execute this file, via this sequence of steps: visiting the management page, clicking on the template, clicking on Default Template Management, clicking on...

CVE-2019-8933

CVE-2019-8933 affects DedeCMS 5.7SP2. An attacker can upload a PHP file to uploads/ and execute it by abusing the management/template workflow: navigate to Default Template Management, create a New Template, and alter the filename from ../index.html to ../index.php. This indicates a path/filename...

eDirectory - SQL Injection

Exploit Title: Admin auth bypass, SQLi and File Disclosure Google Dork: no defacers please ! Date: March 2019 reported to vendor without response :D Exploit Author: Efren Diaz Author contact: https://twitter.com/elefr3n Vendor Homepage: https://www.edirectory.com/ Software Link: not available...

Typo3 CMS Shop System tt_products 2.9.4 SQL Injection

Exploit Title : Typo3 CMS Shop System ttproducts 2.9.4 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 18/02/2019 Vendor Homepage : ttproducts.de jambage.com typo3.org Software Download Links :...

qdPM 9.1 - search_by_extrafields[] SQL Injection Vulnerability

Exploit for php platform in category web applications =========================================================================================== Exploit Title: qdPM 9.1 - 'searchbyextrafields' SQL Injection Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

GetSimpleCMS 3.3.13 Open Redirect

Open Redirection Vulnerability in GetSimpleCMS 3.3.13 Information -------------------- Advisory by Netsparker Name: Open Redirection Vulnerability in GetSimpleCMS Affected Software: GetSimpleCMS Affected Versions: 3.3.13 Homepage: http://get-simple.info/ Vulnerability: Open Redirection Severity:...

qdPM 9.1 SQL Injection

=========================================================================================== Exploit Title: qdPM 9.1 - 'searchbyextrafields' SQL Injection Date: 14-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: http://qdpm.net Software Link:...

Rukovoditel Project Management CRM 2.4.1 - Cross-Site Scripting

Exploit Title : Rukovoditel Project Management CRM 2.4.1 - XSS Vulnerability DOM BASED Author Discovered By : Mehmet EMIROGLU Date : 29/01/2019 Vendor Homepage : https://www.rukovoditel.net/ Software Link : https://sourceforge.net/projects/rukovoditel/ Affected Versions : 2.4.1 Tested On : Wampp,...

CVE-2019-7753

Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter...

NUUO NVRmini - upgrade_handle.php Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NUUO NVRmini upgradehandle.php Remote Command Execution', 'Description' = %q This exploits a vulnerability in the web application of NUUO NVRmini...

NUUO NVRmini upgrade_handle.php Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'NUUO NVRmini upgradehandle.php Remote Command Execution', 'Description' = %q This exploits a vulnerability in the web application of NUUO NVRmini...

osCommerce 2.3.4.1 - products_id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: osCommerce 2.3.4.1 - 'productsid' SQL Vulnerabilities Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.oscommerce.com Software Link: https://www.oscommerce.com/Products Version: 2.3.4.1 Category: Webapps Tested on:...

NUUO NVRmini upgrade_handle.php Remote Command Execution Exploit

This Metasploit module exploits a vulnerability in the web application of NUUO NVRmini IP camera, which can be done by triggering the writeuploaddir command in the upgradehandle.php file. This module requires Metasploit: https://metasploit.com/download Current source:...

osCommerce 2.3.4.1 - currency SQL Injection

osCommerce 2.3.4.1 - currency SQL Injection Exploit Title: osCommerce 2.3.4.1 - 'currency' SQL Vulnerabilities Dork: N/A Date: 05-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://www.oscommerce.com Software Link: https://www.oscommerce.com/Products Version: 2.3.4.1 Category: Webap...

How to browse the Internet safely at work

This Safer Internet Day, we teamed up with ethical hacking and web application security company Detectify to provide security tips for both workplace Internet users and web developers. This article is aimed at employees of all levels. If you’re a programmer looking to create secure websites, visi...