Shiksha Education Website Script SQL Injection

Vulnerability: SQL Injection + Authentication Bypass Date: 18.01.2017 Vendor Homepage: http://www.scriptgiant.com/ Script Name: Shiksha Educational Website Script Script Buy Now: http://www.popularclones.com/products/Shiksha-Educational Author: Ihsan Sencan Author Web: http://ihsan.net Mail :...

Cloud 5 Solutions Admin Panel Bypass Vulnerability

Exploit for php platform in category web applications ++++++++++++++++++++++ + + Exploit Title : Cloud 5 Solutions Admin Panel Bypass + Dork : intext:"Web Design and Maintenance by Cloud 5 Solutions" + Author : Jupa + Team: TunisianHackers + Tested on : Windows 7/Firefox + + Admin Panel :...

Hindu Matrimonial Script - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Vulnerability:: Admin Login Bypass & SQLi + Add/Edit Date: 13.01.2017 Vendor Homepage: http://www.phpmatrimonialscript.in/ Script Name: Hindu Matrimonial Script Script Buy Now: http://www.phpmatrimonialscript.in/product/hindu-matrimonial-scrip...

Malware exploit: Tinba

Wikipedia Type: SQLi \tinybanker panel\admin/control/logs.act.php http://localhost/logs.act.php Post Data: botuid=1&botcomment=mate POST...

WordPress WP Support Plus Responsive Ticket System 7.1.3 Plugin - Privilege Escalation Vulnerability

Exploit for php platform in category web applications Exploit Title: WP Support Plus Responsive Ticket System 7.1.3 Privilege Escalation Date: 10-01-2017 Software Link: https://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/ Exploit Author: Kacper Szurek Contact:...

Rockstar Games: [IMP] - Blind XSS in the admin panel for reviewing comments

@anshumanbh discovered that it is possible to exploit a Blind XSS vulnerability under the "MOUTHOFF TO ROCKSTAR" section while providing feedback. The result is a XSS vulnerability being exploited on an internal Rockstar Games domain. The way this worked was that an attacker would submit a...

Rumble Mail Server 0.51.3135 Cross Site Scripting

Exploit title: Rumble Mail Server v/0.51.3135 = Stored Cross Site Scripting Download Software: https://sourceforge.net/projects/rumble/?source=directory Author: Nassim Asrir Author Company: Henceforth Contact: [email protected] Tested On: Win7 What is Rumble: --------------------------------...

Xfinity Gateway (Technicolor DPC3941T) - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Date: 09/08/2016 Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The Device DPC3941T is vulnerable to...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

XFINITY Gateway Technicolor DPC3941T Cross Site Request Forgery Vulnerability

XFINITY Gateway Technicolor DPC3941T wifi password changing cross site request forgery proof of concept code. Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The...

XFINITY Gateway Technicolor DPC3941T Cross Site Request Forgery

Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Date: 12/12/2016 Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The Device DPC3941T is vulnerable to CSRF and has no security on the entire admin panel for it...

NETGEAR R7000 - Cross-Site Scripting

NETGEAR R7000 - Cross-Site Scripting Exploit Title: Netgear R7000 - XSS via. DHCP hostname Date: 11-12-2016 Exploit Author: Vincent Yiu Contact: https://twitter.com/vysecurity Vendor Homepage: https://www.netgear.com/ Category: Hardware / WebApp Version: V1.0.7.21.1.93 + LATEST to date...

Netgear R7000 - Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Netgear R7000 - XSS via. DHCP hostname Date: 11-12-2016 Exploit Author: Vincent Yiu Contact: https://twitter.com/vysecurity Vendor Homepage: https://www.netgear.com/ Category: Hardware / WebApp Version: V1.0.7.21.1.93 +...

Netgear R7000 - Cross-Site Scripting

Exploit Title: Netgear R7000 - XSS via. DHCP hostname Date: 11-12-2016 Exploit Author: Vincent Yiu Contact: https://twitter.com/vysecurity Vendor Homepage: https://www.netgear.com/ Category: Hardware / WebApp Version: V1.0.7.21.1.93 + LATEST to date -Vulnerability An user who has access to send...

Nextcloud: Login Hints on Admin Panel

Hi, Hope you are doing fine. I wanted to inform you regarding the enabling of the login hints on your wp-admin panelhttps://nextcloud.com/wp-login.php. Vulnerability: The admin panel shows very "specific" hint information if a hacker tries for a bruteforcing attack. Steps to reproduce: 1. Navigat...

Starbucks: Stored XSS in Adress Book (starbucks.com/account/profile)

Hello, I just found a stored XSS in the "Adress book menu" of a user's profile : https://www.starbucks.com/account/profile Description : XSS is happening due to the lack of filtering on the Address.FirstName parameter when you POST a new address on the URL :...

WordPress Caldera Forms 1.3.5.3 Cross Site Scripting Vulnerability

WordPress Caldera Forms plugin version 1.3.5.3 suffers from a cross site scripting vulnerability. ------------------------------------------------------------------------ Cross-Site Scripting vulnerability in Caldera Forms WordPress Plugin...

WordPress WassUp Real Time Analytics 1.9 Plugin - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptinginwassuprealtimeanalyticswordpressplugin.html Persistent Cross-Site Scripting in WassUp Real Time Analytics WordPress Plugin Abstract A stored Cross-Site Scripting XSS...

GitLab 任意用户 authentication tokens 泄漏导致远程代码执行漏洞

漏洞分析参考： http://paper.seebug.org/104/ The project export feature serializes the user objects of team members and stores it in the project.json file. This object contains the authenticationtoken for every user, meaning that an attacker can simply go ahead and create a project on GitLab.com, add one...

WordPress Plugin WassUp Real Time Analytics 1.9 - Persistent Cross-Site Scripting

Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptinginwassuprealtimeanalyticswordpressplugin.html Persistent Cross-Site Scripting in WassUp Real Time Analytics WordPress Plugin Abstract A stored Cross-Site Scripting XSS vulnerability has been found in the WassUp Real Time...