2918 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in the admin-login panel admin/index.cgi in Cosmoshop allows remote attackers to inject arbitrary web script or HTML via the username field uname parameter...
CVE-2015-2103
Cross-site scripting XSS vulnerability in the admin-login panel admin/index.cgi in Cosmoshop allows remote attackers to inject arbitrary web script or HTML via the username field uname parameter...
CVE-2015-2103
Cross-site scripting XSS vulnerability in the admin-login panel admin/index.cgi in Cosmoshop allows remote attackers to inject arbitrary web script or HTML via the username field uname parameter...
CVE-2015-2103
CVE-2015-2103 describes a Cross‑site Scripting (XSS) flaw in Cosmoshop’s admin-login panel (admin/index.cgi). The vulnerability allows remote attackers to inject arbitrary web script or HTML through the username field (u_name parameter). According to the NVD entry, the impact is partial integrity...
CVE-2015-2103: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the admin-login panel admin/index.cgi in Cosmoshop allows remote attackers to inject arbitrary web script or HTML via the username field uname parameter...
PT-2015-5610
Name of the Vulnerable Software and Affected Versions Cosmoshop affected versions not specified Description A cross-site scripting XSS issue exists in the admin-login panel, specifically in the admin/index.cgi endpoint, allowing remote attackers to inject arbitrary web script or HTML via the u na...
Cosmoshop - XSS on Admin-Login Mask
author: l0om page: l0om.org date: 14.02.2015 Cosmoshop is a simple webshop designed for the german market. There is a simple XSS flaw at the admin-login panel in probably all cosmoshop versions. The admin login can be found at http://www.shop-site.de/cgi-bin/cosmoshop/admin/index.cgi This page wi...
Cosmoshop Cross Site Scripting
author: l0om page: l0om.org date: 14.02.2015 Cosmoshop is a simple webshop designed for the german market. There is a simple XSS flaw at the admin-login panel in probably all cosmoshop versions. The admin login can be found at http://www.shop-site.de/cgi-bin/cosmoshop/admin/index.cgi This page wi...
ecshop a CAPTCHA bypass logic vulnerability-vulnerability warning-the black bar safety net
Although the code is encrypted, but logically there is a point problem The problem ..\includes\clscaptcha.php By the verification function can be seen directly returned, and no authentication failure processing function checkword$word $recorded = isset$SESSION$this-sessionword ?...
RomPager Authentication Bypass Attempt - Misfortune Cookie
A vulnerability exists in RomPager web servers. The vulnerability is due to lack of sanitation of the Cookie header. A successful exploitation of this vulnerability allows an attacker to log into the web server under admin privileges...
Citrix CloudPlatform Default Credentials
The remote Citrix CloudPlatform web administration interface uses a known set of default credentials. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid79641; scriptversion"1.5";...
clientResponse Client Management 4.1 - Cross-Site Scripting
Exploit Title: clientResponse Client Management XSS Vulnerability Date: 14-10-2014 Exploit Author: Halil Dalabasmaz Version: v4.1 Vendor Homepage: http://codecanyon.net/item/clientresponse-responsive-php-client-management/3797780 Tested on: Chrome & Iceweasel Vulnerability Description: ===Stored...
Monstra <= 3.0.1 Admin Bruteforce Limit Bypass
Monstra versions 3.0.1 and below keep a tally client side in a cookie to count login attempts, allowing an attacker to completely bypass their abuse functionality. admin/index.php :33-42 // Admin login if Request::post'loginsubmit' if Cookie::get'loginattempts' && Cookie::get'loginattempts' = 5...
Wing FTP Server Authenticated Command Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote include Msf::Exploit::CmdStager include Msf::Exploit::Remote::HttpClient def...
PT-2014-1976 · D Link · Dns-325 +6
Name of the Vulnerable Software and Affected Versions: D-Link DNS-320L versions prior to 1.04b12 D-Link DNS-327L versions prior to 1.03b04 Build0119 D-Link DNR-326 version 1.40b03 D-Link DNS-320B version 1.02b01 D-Link DNS-345 version 1.03b06 D-Link DNS-325 version 1.05b03 D-Link DNS-322L version...
pageadmin注入漏洞
简要描述： rt 详细说明： 管理员登陆处。 获得管理员登陆ip并记录，获得ip方式有问题。 x-forwarded-for注入。 http://bbs.pageadmin.net/showtopic-28377.aspx 20140415 本机测试，X-FORWARDED-FOR:8.8.8.8','20140721'; select from pamember where @@version0 -- 。 官网,demo改了登陆url. /e/master/login.aspx 看ilspy里面的PageAdmin...
Phpyun注入漏洞二
简要描述： 刚在官网下的。 前台注入。 可以直接出管理员的帐号和密码。 无视360webscan。 详细说明： 本来以为挖不到了 无聊翻翻文件看看。 翻到了上次那个注入的文件。 model/register.class.php function regsaveaction $POST=$this-posttrim$POST; $POST'username'=iconv"utf-8","gbk",$POST'username'; $POST'unitname'=iconv"utf-8","gbk",$POST'unitname'; 省略点 ip = $this-obj-funipget;...
phpmps通用SQL注入（demo测试成功）
简要描述： phpmps通用SQL注入（demo测试成功） 详细说明： 版本下载地址： http://www.phpmps.com/down/phpmpsv2.3build140305utf8.zip http://www.phpmps.com/demo/admin/login.php 使用admin/gxy123123登录成功： SQL注入EXP：...
Joomla Flip Wall Component (com_flipwall) SQL Injection Vulnerability
No description provided by source. ========================================================= Joomla Component comflipwall SQL Injection Vulnerability ========================================================= Author : Fl0riX Bug Researchers Name : Joomla comflipwall Bug Type : SQL injection Dork:...
PIGMy-SQL <= 1.4.1 (getdata.php id) Blind SQL Injection Exploit
No description provided by source. !/usr/bin/perl - PIGMy-SQL = 1.4.1 Blind SQL Injection Exploit - PIGMy-SQL is vulnerable because the mysql querys are insecure, therefor it allows an attack to execute sql querys, since the.. ..vulnerable page only returns a picture we have to use a blind sql...