FreePBX 13.0.35 Remote Code Execution

Vulnerable software : Freepbx Tested version : 13.0.35 vendor : freepbx.org Author : Ahmed sultan 0x4148 Email : [email protected] Summary : FreePBX is a web-based open source GUI graphical user interface that controls and manages Asterisk PBX, an open source communication server, With over 1...

GitLab: Ability to access all user authentication tokens, leads to RCE

Vulnerability details The project export feature serializes the user objects of team members and stores it in the project.json file. This object contains the authenticationtoken for every user, meaning that an attacker can simply go ahead and create a project on GitLab.com, add one of the admins ...

Xfinity Gateway (Technicolor DPC3941T) - Cross-Site Request Forgery

Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Date: 09/08/2016 Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The Device DPC3941T is vulnerable to CSRF and has no security on the entire admin panel for it...

Xfinity Gateway (Technicolor DPC3941T) - Cross-Site Request Forgery

Xfinity Gateway Technicolor DPC3941T - Cross-Site Request Forgery Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Date: 09/08/2016 Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The Device DPC3941T is...

InfiniteWP Admin Panel 2.8.0 - authorization bypass

InfiniteWP Admin Panel version 2.8.0 has vulnerable authentication method. Solution Update InfiniteWP Admin Panel plugin at least to 2.9.0 version...

Harvest: Project Disclosure of all Harvest Instances

Hello, The POST request to create new Retainer in admin panel can use and disclose all the projects in @harvest not just available in admin's @harvest instance. Steps to Reproduce: 1. Login to application using admin credentials and traverse to Invoices Retainers + New Retainers 2. Select valid...

ExpressionEngine: Full path + some back-end code disclosure

Hello, Ironically enough, I just discovered a full path disclosure issue. When an admin edits their personal information, a request like the following gets sent: POST /ee/admin.php?/cp/members/profile/settings&id=1 HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 X11; Linux x8664; rv:45.0...

OpenFire 3.10.2 < 4.0.1 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Several vulnerabilities doscovered in OpenFire version 3.10.2 to 4.0.1 Product Description OpenFire is an opensource project under GNU GPL licence. It provides a Jabber/XMPP server fully develloped in Java. It's develloped by the Ignite realti...

Yona CMS 1.3.x Cross Site Request Forgery

Exploit Title: Yona CMS document.forms0.submit;...

Ionize CMS 1.0.8 Cross Site Request Forgery

Exploit Title: IonizeCMS document.forms0.submit;...

Yona CMS - Cross-Site Request Forgery

Exploit for php platform in category web applications document.forms0.submit; 0day.today 2018-01-08...

Yona CMS - Cross-Site Request Forgery

Yona CMS - Cross-Site Request Forgery document.forms0.submit;...

IonizeCMS 1.0.8 - Cross-Site Request Forgery (Add Admin)

document.forms0.submit;...

Yona CMS - Cross-Site Request Forgery

document.forms0.submit;...

Grid Gallery 1.0 - Admin Panel Authentication Bypass

Exploit for php platform in category web applications ======================================================================================================= Grid Gallery 1.0 Admin panel Authentication bypass Description : An Attackers are able to completely compromise the web application built...

Dream Gallery 2.0 - Admin Panel Authentication Bypass

Dream Gallery 2.0 - Admin Panel Authentication Bypass ======================================================================================================= Dream Gallery 2.0 Admin panel Authentication bypass Description : An Attackers are able to completely compromise the web application built...

FRticket Ticket System - Persistent Cross-Site Scripting

Exploit for php platform in category web applications Exploit Title: FRticket - Ticket System - Stored XSS Google Dork: if applicable Date: 11.06.2016 Exploit Author: Hamit ABİŞ Vendor Homepage: http://codecanyon.net/item/frticket-ticket-system/16539836 Version: v1 About Get the world’s most...

Dream Gallery 2.0 Authentication Bypass

======================================================================================================= Dream Gallery 2.0 Admin panel Authentication bypass Description : An Attackers are able to completely compromise the web application built upon Dream Gallery as they can gain access to the admi...

FRticket Ticket System - Persistent Cross-Site Scripting

Exploit Title: FRticket - Ticket System - Stored XSS Google Dork: if applicable Date: 11.06.2016 Exploit Author: Hamit ABİŞ Vendor Homepage: http://codecanyon.net/item/frticket-ticket-system/16539836 Version: v1 About Get the world’s most popular customer support ticket system. FRticket is...

FRticket Ticket System 1 Cross Site Scripting

Exploit Title: FRticket - Ticket System - Stored XSS Google Dork: if applicable Date: 11.06.2016 Exploit Author: Hamit ABİŞ Vendor Homepage: http://codecanyon.net/item/frticket-ticket-system/16539836 Version: v1 About Get the world’s most popular customer support ticket system. FRticket is...