CVE-2010-2843

Cisco Wireless LAN Controller (WLC) software is listed as affected (likely versions 4.2 through 6.0). The CVE describes a vulnerability where remote authenticated users can bypass access restrictions and modify configuration, and potentially obtain administrative privileges, via unspecified vecto...

eUploader PRO 3.1.1 - Cross-Site Request Forgery Cross-Site Scripting

eUploader PRO 3.1.1 - Cross-Site Request Forgery Cross-Site Scripting ----------------------------------------------------------------------------------------------- Title: eUploader PRO 3.1.1 XSRF/XSS Multiple Vulnerabilities Author: Milos Zivanovic Email: milosz.securityatgmail.com Date: 16...

Input validation

Cacti 0.8.7e and earlier allows remote authenticated administrators to gain privileges by modifying the "Data Input Method" for the "Linux - Get Memory Usage" setting to contain arbitrary commands...

CuteNews 1.4.6 - 'index.php' Cross-Site Request Forgery (New User Creation)

source: https://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that exploits for some of the issues may...

CuteNews 1.4.6 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/36971/info CuteNews and UTF-8 CuteNews are prone to multiple vulnerabilities, including cross-site scripting, HTML-injection, information-disclosure, arbitrary-script-injection, and security-bypass issues. Note that exploits for some of the issues may...

FMyClone 2.3 Multiple SQL Injection Vulnerabilities

No description provided by source. FMyClone V2.3 Multiple SQLi By learn3r hacker from nepal [email protected] Product name: FMyClone Version: 2.3 or maybe lower Home: fmyclone.com Different things might require some privileges to work but still sometimes these might be useful. Vulns in th...

FMyClone 2.3 Multiple SQL Injection Vulnerabilities

Exploit for unknown platform in category web applications =================================================== FMyClone 2.3 Multiple SQL Injection Vulnerabilities =================================================== FMyClone V2.3 Multiple SQLi By learn3r hacker from nepal Product name: FMyClone...

MyBB <= 1.4.6 Remote Code Execution Exploit

Exploit for unknown platform in category web applications =========================================== MyBB = 1.4.6 Remote Code Execution Exploit =========================================== ?PHP / Someone decided to contact mybb's staff informing about this vulnerability with the obvious result th...

Limbo CMS 1.0.4.2 - Cross-Site Request Forgery / Privilege Escalation

Limbo cms v 1042Lt Cross-site request forgery Privilege Escalation Proof of Concept by Alfons Luja download : http://www.limboportal.com/index.php/option/downloads/task/download/id/67 d00rk: intext:"site powered by limbo" inurl:task=register Sytuacion is similar to last vuln in Coppermine...

MindDezign Photo Gallery 2.2 Arbitrary Add Admin Exploit

No description provided by source. !/usr/bin/perl ============================================================= MindDezign Photo 2.2 Gallery Arbitrary Add Admin Exploit ============================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | ...

MindDezign Photo Gallery 2.2 - Arbitrary Add Admin

MindDezign Photo Gallery 2.2 - Arbitrary Add Admin !/usr/bin/perl ============================================================= MindDezign Photo 2.2 Gallery Arbitrary Add Admin Exploit ============================================================= ,--^----------,--------,-----,-------^--, |...

Rianxosencabos CMS 0.9 Arbitrary Add-Admin Vulnerability

No description provided by source. ============================================================ Rianxosencabos CMS 0.9 Arbitrary Add-Admin Vulnerability ============================================================ ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH...

Anata CMS 1.0b5 - change.php Arbitrary Add Admin

Anata CMS 1.0b5 - change.php Arbitrary Add Admin =============================================== Anata CMS 1.0b5 Arbitrary Add-Admin Exploit =============================================== ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

IPTBB 0.5.6 - Arbitrary Add Admin

IPTBB 0.5.6 - Arbitrary Add Admin ========================================= IPTBB 0.5.6 Arbitrary Add-Admin Exploit ========================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...

Wordpress <= 2.3.1 Charset Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================= Wordpress Affected version: WordPress = 2.3.1 Exploit type: Remote Risk: Moderate CVE: pending 1. Summary 2. Detail 3. Proof of concept 4. Workaround 1. Summary Quoting from...

hackflatnuke.txt

/ hackflatnuke.txt Tested on 2.6 FlatNuke version can work on 3 but it has to be modified With this trick you can steal/modifie a flatnuke account by changing the password and all the profile or change your profile and become an admin Requirements: - You have to know the nickname of the account u...

saforum 注射漏洞

saforum是国内安全研究人员修改过的saforum论坛,但是代码中有一点瑕疵导致可能被获取管理员权限: \include\common.php 行4149引入没有过滤的变量 ------cut----------------- ifgetenv'HTTPCLIENTIP' $onlineip = getenv'HTTPCLIENTIP'; elseifgetenv'HTTPXFORWARDEDFOR' $onlineip = getenv'HTTPXFORWARDEDFOR'; elseifgetenv'REMOTEADDR' $onlineip =...

Alstrasoft Template Seller Pro 3.25 - Admin Password Change

!/usr/bin/php -q -d shortopentag=on Thanks to rgod for the php code and Marty for the Love "; if $argc4 echo "Usage: php ".$argv0." Host Path ID password Host: target server ip/hostname Path: path of template ID: A Valid Admin ID usally 1 works for the 'admin' nickname password: The PWD you want ...

CVE-2006-6878

admin/uploads.php in PHP-Update 2.7 and earlier allows remote attackers to gain privileges by setting the rights7 parameter to 1 during a login action...

CVE-2006-5909

generaloptions.php in Paul Tarjan Stanford Conference And Research Forum SCARF before 20070227 does not require the admin privilege, which allows remote attackers to reconfigure the application or its user accounts...