Product Catalog 8 1.2 - Unauthenticated SQL Injection

$POST ‘selectedCategory’ is not escaped. UpdateCategoryList is accessible for any user...

Sirv <= 1.3.1 - Authenticated SQL Injection

$POST ‘id’ is not escaped. sirvgetrowbyid is accessible for every registered user. $id = $POST'rowid'; $row = $wpdb-getrow"SELECT FROM $tablename WHERE id = $id", ARRAYA; $row'images' = unserialize$row'images'; echo jsonencode$row;...

WordPress 4.5 admin-ajax.php Path traversal & DoS

Impact version WordPress 4.6 4.5.3 test by Analysis The above code can be seen, the directory traversal vulnerability is triggered in security checks before. No echo is slightly tasteless, but the attacker can use this directory through repeated read/dev/random blocking the php script, resulting ...

JobScript Remote Code Execution

!C:/Python27/python.exe -u JobScript Remote Code Execution Exploit Vendor: Jobscript Product web page: http://www.jobscript.in Affected version: Unknown Summary: JobScript is inbuilt structured website was developed in PHP and MySQL database. It's a complete job script for those who wants to star...

JobScript Open Redirection And Arbitrary Code Execution Vulnerability

Summary JobScript is inbuilt structured website was developed in PHP and MySQL database. It's a complete job script for those who wants to start a professional job portal website like naukri.com, monster.com, clickjobs.com or any such major job portals. Jobscript was designed and developed with t...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the formfields parameter in a 1 doedit or 2 doinsert action to wp-admin/admin-ajax.php...

CVE-2014-7151: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the NEX-Forms Lite plugin 2.1.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the formfields parameter in a 1 doedit or 2 doinsert action to wp-admin/admin-ajax.php...

Wordpress VideoWhisper Video Presentation plugin XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress plugin videowhisper-video-presentation XSS Vulnerability Vendor or Software Link: https://wordpress.org/plugins/videowhisper-video-presentation/ Google dork: inurl:/wp-content/plugins/videowhisper-video-presentation Th...

Wordpress Plugin Store Locator Plus 4.2.23 Email Injection

如果我们拥有有效的“钥匙”就可以发送邮件给任何人File: store-locator-le\include\send-email.phpif !wpverifynonce$REQUEST'valid','em' die; $messageheaders = "From: "$GET'emailname'"...

omsinc.in XSS vulnerability

Vulnerable URL: http://www.omsinc.in/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Rahul Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 15379222 Google Pagerank| 0 VIP...

coorgvacations.in XSS vulnerability

Vulnerable URL: http://coorgvacations.in/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Rahul Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 15376895 Google Pagerank| 0...

vayavyalabs.com XSS vulnerability

Vulnerable URL: http://vayavyalabs.com/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Rahul Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1659207 Google Pagerank| 3 VIP...

ralphwendel.fr XSS vulnerability

Vulnerable URL: http://www.ralphwendel.fr/wp-admin/admin-ajax.php?action=revsliderajaxactionaction=%3Ch1%3ER3NW4%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cimg%20src=x%20onerror=prompt%28String.fromCharCode%2847,88,83,83,80,79,83,69,68,47%29%29%20/%3E%3C!-- Details: Description| Value ---|--- Patched:| Ye...

essexyouthbuild.co.uk XSS vulnerability

Vulnerable URL: http://essexyouthbuild.co.uk/wp-admin/admin-ajax.php?action=revsliderajaxactionaction=%3Ch1%3ER3NW4%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cimg%20src=x%20onerror=prompt%28String.fromCharCode%2847,88,83,83,80,79,83,69,68,47%29%29%20/%3E%3C!-- Details: Description| Value ---|--- Patched:|...

locksolution4u.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-83581 Description| Value ---|--- Affected Website:| locksolution4u.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

blackhawkghad.com XSS vulnerability

Open Bug Bounty ID: OBB-83568 Description| Value ---|--- Affected Website:| blackhawkghad.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

socalurbanfarms.com XSS vulnerability

Open Bug Bounty ID: OBB-83543 Description| Value ---|--- Affected Website:| socalurbanfarms.com Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...

salsaole.ca XSS vulnerability

Open Bug Bounty ID: OBB-83516 Description| Value ---|--- Affected Website:| salsaole.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

quantdev.ssri.psu.edu XSS vulnerability

Vulnerable URL: http://quantdev.ssri.psu.edu/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Derp Details: Description| Value ---|--- Patched:| Yes, at 12.04.2016 Latest check for patch:| 12.04.2016 16:21 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

jezeph.co.uk XSS vulnerability

Vulnerable URL: http://www.jezeph.co.uk/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= Derp Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 14:02 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...