Weblate: full path disclosure at hosted.weblate.org/admin/accounts/profile/

Browsing this link https://hosted.weblate.org/admin/accounts/profile/ will ask for admin username and password as asked when browsing https://hosted.weblate.org/admin/accounts/ or https://hosted.weblate.org/admin/ hence disclosing the directory path of forbidden area. screenshot : path.png also i...

Brother Devices - Authentication Bypass / Password Change Exploit

Most of Brother devices web authorization can be bypassed through a trivial bug in the login process. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

ZYCHCMS V04 Login Authentication Bypass Vulnerability in /admin/login.asp File

ZYCHCMS is an enterprise website management system. A login authentication bypass vulnerability exists in the /admin/login.asp file in ZYCHCMS V04. The vulnerability allows attackers to bypass authentication to enter the backend and obtain sensitive information...

CVE-2016-7834

SONY SNC-CH115, SNC-CH120, SNC-CH160, SNC-CH220, SNC-CH260, SNC-DH120, SNC-DH120T, SNC-DH160, SNC-DH220, SNC-DH220T, SNC-DH260, SNC-EB520, SNC-EM520, SNC-EM521, SNC-ZB550, SNC-ZM550, SNC-ZM551, SNC-EP550, SNC-EP580, SNC-ER550, SNC-ER550C, SNC-ER580, SNC-ER585, SNC-ER585H, SNC-ZP550, SNC-ZR550,...

Design/Logic Flaw

Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack...

CVE-2017-7359

Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack...

Design/Logic Flaw

Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to the IP camera with admin credentials so as to obtain full control of the target IP camera. During exploitation, the fir...

CVE-2017-7253

Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to the IP camera with admin credentials so as to obtain full control of the target IP camera. During exploitation, the fir...

CVE-2017-7253

Dahua IP Camera devices 3.200.0001.6 can be exploited via these steps: 1. Use the default low-privilege credentials to list all users via a request to a certain URI. 2. Login to the IP camera with admin credentials so as to obtain full control of the target IP camera. During exploitation, the fir...

Weak password vulnerability in zabbix (CNVD-2017-03462)

Zabbix is a WEB-based interface to provide distributed system monitoring and network monitoring capabilities of enterprise-class open source solutions . A large number of domestic zabbix has a weak password vulnerability. Allow attackers to utilize the account password for Admin/zabbix to log in ...

Website Broker Script 3.02 - 'view' SQL Injection

Exploit Title: Website Broker Script v3.02 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/website-broker-script/ Demo: http://www.officialwebsiteforsale.com/official/ Version: 3.02 Tested on: Win7...

WordPress Adminer Plugin Allows Public Admin (Local) Database Login Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. The WordPress Adminer plugin allows public administrative local database logins, which can be exploited by an attacker to log...

TI Online Examination System 2.0 Admin Login Bypass Vulnerability

Exploit for php platform in category web applications --------------------------------------------------------------------------------------- + TI Online Examination System = 2.0 sql injection Admin Login Bypass -------------------------------------------------------------------------------------...

Nozes - PeTest CMD Manager [Automate Your PenTest Attacks In One Click]

Nozes is a Pentest cmd manager. You can automate your pentest attacks in one click and get results... Read the docs: https://github.com/CoolerVoid/nozes/blob/master/doc/nozesapresentation1.pdf Install To install: Need: httpd server with TLS/SSL SQLite3 php5 and php5-sqlite and PDO driver of sqlit...

MC Documentation Creator Script - SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability: SQL Injection Web Vulnerability Date: 15.01.2017 Vendor Homepage: http://microcode.ws/ Script Name: MC Documentation Creator Script Buy Now: http://microcode.ws/product/mc-documentation-creator-php-script/3890 Author: İhsan Şenc...

e-Soft24 Jokes Portal Script Seo 1.3 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Vulnerability: Admin Login Bypass & SQLi Date: 15.01.2017 Vendor Homepage: http://www.e-soft24.com/ Script Name: Jokes Portal Script Seo Script Version: v1.3 Script Buy Now: http://www.e-soft24.com/jokes-portal-script-seo-p-370.html Author:...

MC Inventory Manager Script - Multiple Vulnerabilities

Exploit for php platform in category web applications Vulnerability: Admin Login Bypass & SQLi Date: 15.01.2017 Vendor Homepage: http://microcode.ws/ Script Name: MC Inventory Manager Script Buy Now: http://microcode.ws/product/mc-inventory-manager-php-script/3885 Author: İhsan Şencan Author Web:...

MC Buy and Sell Cars Script 1.1 - SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability: SQL Injection Web Vulnerability Date: 15.01.2017 Vendor Homepage: http://microcode.ws/ Script Name: MC Buy and Sell Cars Script Script Version: V1.1 Script Buy Now: http://microcode.ws/product/mc-buy-and-sell-cars-php-script/387...

MC Smart Shop Script - SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability: SQL Injection Web Vulnerability Date: 15.01.2017 Vendor Homepage: http://microcode.ws/ Script Name: MC Smart Shop Script Script Buy Now: http://microcode.ws/product/mc-smart-shop-php-script/3855 Author: İhsan Şencan Author Web:...

MC Yellow Pages Script - SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability: SQL Injection Web Vulnerability Date: 15.01.2017 Vendor Homepage: http://microcode.ws/ Script Name: MC Yellow Pages Script Script Buy Now: http://microcode.ws/product/mc-yellow-pages-php-script/3800 Author: İhsan Şencan Author...