XenAPI For XenForo 1.4.1 SQL Injection

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI Type: SQL Injection CWE-89 Date found: 2016-05-20 Date published: 2016-05-23 CVSSv3 Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE...

XenAPI 1.4.1 for XenForo - Multiple SQL Injections

Exploit for php platform in category web applications 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI Type: SQL Injection CWE-89 Date found: 2016-05-20 Date published: 2016-05-23 CVSSv3 Score: 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N...

XenAPI 1.4.1 for XenForo - Multiple SQL Injections

XenAPI 1.4.1 for XenForo - Multiple SQL Injections RCESEC-2016-002 XenAPI v1.4.1 for XenForo Multiple Unauthenticated SQL Injections RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI...

XenAPI 1.4.1 for XenForo - Multiple SQL Injections

RCESEC-2016-002 XenAPI v1.4.1 for XenForo Multiple Unauthenticated SQL Injections RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenAPI for XenForo Vendor URL: github.com/Contex/XenAPI Type: SQL Injection CWE-89 Date found: 2016-05-20 Da...

XenForo Forum Detection

This script detects an installed XenForo Forum. SPDX-FileCopyrightText: 2016 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

Tapatalk Detection (HTTP)

HTTP based detection of Tapatalk. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.111039";...

XenForo 1.4.9 Cross Site Scripting

Credits: snop. + Domains: rabbitz.org Vulnerability Type: =================== XSS Vendor: =================== www.xenforo.com Product: ===================================================================== XenForo = 1.4.9 A compelling community experience. Intuitive. Social. Engaging. Fast...

Tapatalk Open Redirect

Tapatalk Plugin for XenForo and vBulletin suffer of Open redirect. Vendor: http://tapatalk.com Dork: inurl: mobiquo/mobiquo.php Plugin versions: Tapatalk plugin for vBulletin: 5.2.2 Tapatalk plugin for Xenforo: 2.3.5 Description: Tapatak Plugin allow to arbitrary redirect users to external websit...

Issue with SWFUploader Could Lead to XSS Vulnerabilities, Content Spoofing

UPDATED Many versions of SWFUpload – an applet that combines Flash and JavaScript that’s used in millions of websites, including WordPress sites– are vulnerable to content spoofing and a cross-site scripting vulnerability that could lead to the takeover of accounts, according to reports this week...

XSS vulnerability in web applications with swfupload: AionWeb, Magento, Liferay Portal, SurgeMail, symfony.

Hello 3APA3A! I will draw your attention to XSS vulnerability in other web applications with swfupload. Earlier I've wrote about swfupload in Dotclear, InstantCMS, AionWeb, Dolphin and that this hole is available in many other web applications. In previous letter I've wrote concerning web...

XSS vulnerability in web applications with swfupload: Dotclear, XenForo, InstantCMS, AionWeb, Dolphin

Hello 3APA3A! I will draw your attention to XSS vulnerability in other web applications with swfupload. Earlier I've wrote about swfupload in WordPress CVE-2012-3414 and that this hole is available in many web applications. In previous letter I've wrote the information about different versions of...

SWF Upload Cross Site Scripting

Hello list! I will draw your attention to XSS vulnerability in other web applications with swfupload. Earlier I've wrote about swfupload in WordPress CVE-2012-3414 and that this hole is available in many web applications. In previous letter I've wrote the information about different versions of...