DigitalHive 2.0 RC2 - 'user_id' SQL Injection

body margin:3%; font-size:10px; color:FFFFFF; font-family:Verdana,Arial; background-color:1a1a1a; text-align: center; input background:303030; color:FFFFFF; font-family:Verdana,Arial; font-size:10px; vertical-align:middle; border-left:1px solid 5d5d5d; border-right:1px solid 121212;...

CVE-2008-0205

CVE-2008-0205 concerns the WordPress Math Comment Spam Protection plugin (version 2.1 and earlier). The vulnerability is a set of cross-site request forgery (CSRF) flaws in the file math-comment-spam-protection.php that let remote attackers perform administrator actions via the parameters mcsp_op...

Hosting Controller - Multiple Security Bugs (Extremely Critical)

Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary solution in this report Exploit:...

Galaxie CMS 'category.php' SQL注入漏洞

BUGTRAQ ID: 26853 CNCAN ID:CNCAN-2007121404 Galaxie CMS是一款基于PHP的WEB应用程序。 Galaxie CMS不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞进行SQL注入攻击，可获得敏感信息或操作数据库。 问题是由于'category.php'脚本对用户提交的'categoryid'参数处理缺少充分过滤，提交恶意SQL查询作为参数数据，可更改原来的SQL逻辑，获得敏感信息或操作数据库。 Galaxie Software Galaxie CMS 暂无...

Hosting Controller 6.1 Hot fix <= 3.3 Multiple Remote Vulnerabilities

No description provided by source. Title: Multiple Security Bugs In Hosting Controller Critical: Extremely critical Impact: Full system administrator access Vendor: Hosting Controller Version: 6.1 Hot fix = 3.3 Vendor URL: www.hostingcontroller.com Solution: N/A From company - There is temporary...

Authentication flaw

Install.php in BosDev BosNews 4 and 5 does not require authentication for replacing an existing product installation or creating a new admin account, which allows remote attackers to cause a denial of service overwritten files and possibly obtain administrative access...

CVE-2003-1488

The 1 verifadmin.php and 2 checkadmin.php scripts in Truegalerie 1.0 allow remote attackers to gain administrator access via a request to admin.php without the connect parameter and with the loggedin parameter set to any value, such as 1...

Arbitrary Command Inclusion

/ hackflatnuke.txt Tested on 2.6 FlatNuke version can work on 3 but it has to be modified With this trick you can steal/modifie a flatnuke account by changing the password and all the profile or change your profile and become an admin Requirements: - You have to know the nickname of the account u...

JBlog 1.0 - 'index.php?id' SQL Injection

Script....................................: JBlog ver 1.0 Script Site...........................: http://www.jmuller.net/jblog/index.php Vulnerability........................: Remote SQL injection Exploit Access..................................: Remote level.........................................

MKPortal 1.01.1 - admin.php Authentication Bypass

MKPortal 1.01.1 - admin.php Authentication Bypass source: https://www.securityfocus.com/bid/25515/info MKPortal is prone to an authentication-bypass vulnerability because it fails to restrict access to certain administrative functions. Attackers can exploit this issue to gain unauthorized access ...

[Full-disclosure] EZPhotoSales 1.9.3 Multiple Vulnerabilities

http://www.airscanner.com/security/07080601ezphotosales.htm Airscanner Mobile Security Advisory 07080601: EZPhotoSales 1.9.3 Multiple Vulnerabilities Product: EZPhotoSales 1.9.3 and below Platform: Windows IIS or Apache with PHP Requirements: Windows IIS or Apache with PHP Credits: Seth Fogie...

Aigaion 1.3.3 - 'topic topic_id' SQL Injection

--==+================================================================================+==-- --==+ Aigaion = 1.3.3 SQL Injection Exploit +==-- --==+================================================================================+==-- DISCOVERED BY: Cody "CypherXero" Rester PAYLOAD: Admin username a...

SuperCali PHP Event Calendar 0.4.0 - SQL Injection

--==+================================================================================+==-- --==+ SuperCali Event Calendar SQL Injection Vulnerbility +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

arcade-sql.txt

--==+================================================================================+==-- --==+ Game Portal Manager v1.7 SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

ArcadeBuilder Game Portal Manager 1.7 - SQL Injection

--==+================================================================================+==-- --==+ Game Portal Manager v1.7 SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZz & xprog SITE:...

ArcadeBuilder Game Portal Manager 1.7 Remote SQL Injection Vuln

No description provided by source. --==+================================================================================+==-- --==+ Game Portal Manager v1.7 SQL Injection Vulnerability +==-- --==+================================================================================+==-- AUTHOR: t0pP8uZ...

ArcadeBuilder Game Portal Manager 1.7 Remote SQL Injection Vuln

Exploit for unknown platform in category web applications =============================================================== ArcadeBuilder Game Portal Manager 1.7 Remote SQL Injection Vuln ===============================================================...

ArcadeBuilder Game Portal Manager 1.7 - SQL Injection

ArcadeBuilder Game Portal Manager 1.7 - SQL Injection --==+================================================================================+==-- --==+ Game Portal Manager v1.7 SQL Injection Vulnerability +==--...

SYM07-011 Symantec Reporting Server password disclosure

SYM07-011: Symantec Reporting Server Password Disclosure June 5, 2007 Risk Impact: Medium Remote Access: Yes Local Access: Yes Authentication Required:Yes Exploit available: No Overview The administrator password for Symantec Reporting Server could be disclosed after a failed login attempt...

Pheap 2.0 - config.php Pheap_Login Authentication Bypass

Pheap 2.0 - config.php PheapLogin Authentication Bypass source: https://www.securityfocus.com/bid/24227/info Pheap is prone to an authentication-bypass vulnerability due to a design error. An attacker can exploit this vulnerability to bypass authentication and execute arbitrary commands in the...