WordPress Plugin Userpro < 4.9.17.1 - Authentication Bypass

Exploit Title: Userpro – WordPress Plugin – Authentication Bypass Google Dork: inurl:/plugins/userpro Date: 11.04.2017 Exploit Author: Colette Chamberland Wordfence, Iain Hadgraft Duke University Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?srank=9...

Sql injection

D-Park Pro Domain Parking Script 1.0 allows SQL Injection via the username to admin/loginform.php...

Breacher - Tool To Find Admin Login Pages And EAR Vulnerabilites

A script to find admin login pages and EAR vulnerabilites. Features Multi-threading on demand Big path list 798 paths Supports php, asp and html extensions Checks for potential EAR vulnerabilites Checks for robots.txt Support for custom patns Usages Check all paths with php extension python...

NEXXT Authentication Bypass

Vulnerability Summary The following advisory describes an authentication bypass found in NEXXT routers. NEXXT Connectivity Solutions develops "state of the art networking devices that help connect people and things together, at home, the office and virtually everywhere". Credit An independent...

Stock Photo Selling 1.0 - SQL Injection

Stock Photo Selling 1.0 - SQL Injection !/usr/bin/perl -w Exploit Title: Stock Photo Selling Script 1.0 - SQL Injection Dork: N/A Date: 21.09.2017 Vendor Homepage: http://sixthlife.net/ Software Link: http://sixthlife.net/product/stock-photo-selling-website/ Demo: http://www.photoreels.com/...

HelpDEZk SQL Injection Vulnerability

HelpDEZk is a suite of PHP-based software for managing requests and events. The software manages workflow, logging process and maintenance history through a shared service center. A SQL injection vulnerability exists in the app\modules\admin\controllers\loginController.php file in HelpDEZk versio...

Sql injection

HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATHINFO, related to the selectWarning function...

CVE-2017-14145

HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATHINFO, related to the selectWarning function...

CVE-2017-14145

HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATHINFO, related to the selectWarning function...

CVE-2017-14145

HelpDEZk 1.1.1 has a SQL Injection vulnerability in app/modules/admin/controllers/loginController.php via the admin/login/getWarningInfo/id/ PATH_INFO, related to the selectWarning function. The initial records (CVE-2017-14145) enumerate high-severity impact (C/P/I/A partial) with CVSS2/3 scores ...

PT-2017-13278

Name of the Vulnerable Software and Affected Versions HelpDEZk version 1.1.1 Description The issue concerns a SQL Injection in the loginController.php file, specifically via the "admin/login/getWarningInfo/id/" PATH INFO. This is related to the selectWarning function. Recommendations For HelpDEZk...

CVE-2017-14145: Improper Neutralization of Special Elements used in an SQL Command

HelpDEZk 1.1.1 has SQL Injection in app\modules\admin\controllers\loginController.php via the admin/login/getWarningInfo/id/ PATHINFO, related to the selectWarning function...

PHP Appointment Booking Script - Authentication Bypass Vulnerability

Exploit for php platform in category web applications ======================================================== Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin Proof of Concept : - http://localhost/appointment/adminlogin.php set username...

PHP Appointment Booking Script - Authentication Bypass

PHP Appointment Booking Script - Authentication Bypass ======================================================== Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin Proof of Concept : - http://localhost/appointment/adminlogin.php set username...

Schools Alert Management Script - Authentication Bypass

Schools Alert Management Script - Authentication Bypass ======================================================== Schools Alert Management - SQL injection login bypass Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin of the particular scho...

Car or Cab Booking Script - Authentication Bypass

======================================================== Car or Cab Booking Script - SQL injection login bypass Description : an attacker is able to inject malicious sql query to bypass the login page and login as admin of the particular school Proof of Concept : -...

VehicleWorkshop Authentication Bypass / SQL Injection

Type: Admin or Customer login bypass via SQL injection Author: Touhid M.Shaikh Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Mail: touhidshaikh22atgmaildotcom More info: https://blog.touhidshaikh.com/ ===================== PoC ================ Admin Login Page :...

VehicleWorkshop - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Type: Admin or Customer login bypass via SQL injection Author: Touhid M.Shaikh Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Mail: touhidshaikh22atgmaildotcom More info: https://blog.touhidshaikh.com/ ===================== PoC...

VehicleWorkshop - Authentication Bypass

Type: Admin or Customer login bypass via SQL injection Author: Touhid M.Shaikh Vendor Homepage: https://github.com/spiritson/VehicleWorkshop Mail: touhidshaikh22atgmaildotcom More info: https://blog.touhidshaikh.com/ ===================== PoC ================ Admin Login Page :...

Cagintranet Networks GetSimple CMS Cross-Site Scripting Vulnerability

Cagintranet Networks GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A cross-site scripting vulnerability exists in Cagintranet Networks GetSimple CMS...