Role Scoper WordPress Plugin Reflective Cross-Site Scripting Vulnerability

Role Scoper WordPress plugin is comprehensive access control solution that controls read and edit permissions like a CMS. Role Scoper WordPress 1.3.66 and earlier versions do not effectively filter the "objectname" HTTP GET parameter value of "/wp-admin/admin.php" when "page" is set to...

Shareaholic 7.6.0.3 XSS

File: shareaholic\shareaholic.php addaction'wpajaxshareaholicaddlocation', array'ShareaholicAdmin', 'addlocation'; $POST'location' is not escaped. File: shareaholic\admin.php public static function addlocation $location = $POST'location'; $appname = $location'appname';...

Drupal CMS Updater Module Security Restriction Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP.CMS Updater module for Drupal is a module for Drupal that provides security protection for Drupal websites. A security restriction bypass vulnerability exists in the Drupal CMS Updater module 7.x-1.3 and prior to 7.x-1.x,...

CVE-2015-6965

Multiple cross-site request forgery CSRF vulnerabilities in the Contact Form Generator plugin 2.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 create a field, 2 update a field, 3 delete a field, 4 create a form, 5 update a...

bkkwebs SQL Injection Vulnerability

Exploit for php platform in category web applications + Exploit Title: bkkwebs SQL injection vulnerability + Date: 2015 15 September + Google Dork : intext:"Designed & Developed by bkkwebs.com" + Exploit Author: IranianDarkCodersTeam + Discovered By: KurDHaCK3R + Security Risk: High + Platforms:...

phpBugTracker 1.6.0 /admin/project.php SQL注入

No description provided by source...

Google Analyticator Multiple XSS Vulnerabilities

Proof of Concept URLs for XSS in Google Analyticator 6.4.9.4: Url http://example.com/wordpress/wp-admin/admin.php?page=google-analyticator Parameter Name gaadsense Parameter Type POST Attack Pattern x'" onmouseover=alert9 Url http://example.com/wordpress/wp-admin/admin.php?page=google-analyticato...

WebSolutions India Design CMS - SQL Injection Vulnerability

Document Title: =============== WebSolutions India Design CMS - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1577 Release Date: ============= 2015-08-20 Vulnerability Laboratory ID VL-ID: ===================================...

Photo Gallery CMS for PC, smartphone and feature phone (Free) vulnerable to cross-site request forgery

Overview Photo Gallery CMS for PC, smartphone and feature phone Free provided by PHP Kobo contains a cross-site request forgery CWE-352 vulnerability in admin.php. Yuji Tounai of NTT Com SecurityJapan KK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Informatio...

Frog CMS 0.9.5 Open Redirect

Exploit Title: FrogCMS Open Redirect Vulnerability + Google Dork: N/A + Date: 10/8/2015 + Exploit Author: Arash Khazaei + Vendor Homepage: http://www.madebyfrog.com/ + Software Link: http://www.madebyfrog.com/download.html + Version: 0.9.5Last Version + Tested on: Kali / Mozilla FireFox, Windows...

Wolf CMS 0.8.2 Open Redirect

Exploit Title: Wolf CMS Open Redirect Vulnerability + Google Dork: N/A + Date: 10/8/2015 + Exploit Author: Arash Khazaei + Vendor Homepage: https://www.wolfcms.org/ + Software Link: https://bitbucket.org/wolfcms/wolf-cms-downloads/downloads/wolfcms-0.8.2.zip + Version: 0.8.2Last Version + Tested...

Supercon Infoservices Bypass Admin Page Vulnerability

Exploit for php platform in category web applications +++++++++++++++ + + Exploit Title : Supercon Infoservices Bypass Admin Page Vulnerability + + Exploit Author : Ashiyane Digital Security Team + + Vendor Homepage : http://www.superconinfo.com/ + + Google Dork : intext:"Developed By:Supercon...

Job Manager <= 0.7.22 - Unauthenticated Stored Cross-Site Scripting (XSS)

The Job Manager WordPress plugin was affected by an Unauthenticated Stored Cross-Site Scripting XSS security vulnerability. Go to the job listings page /index.php/jobs/apply/, then click on "send through your résumé", add the payload '" to the email field. The JavaScript will be executed on the...

BDINFOBIZ LIMITED Bypass Admin Page Vulnerability

Exploit for php platform in category web applications +++++++++++++++ + Exploit Title : BDINFOBIZ LIMITED Bypass Admin Page Vulnerability + Exploit Author : Ashiyane Digital Security Team + Vendor Homepage : http://www.bdinfobiz.com/ + Date: 2015-07-29 + Google Dork : intext:"Developed by BDINFOB...

WordPress Copy Or Move Comments 1.0.0 Cross Site Scripting

Title: WordPress 'Copy or Move Comments' Plugin Version: 1.0.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/copy-or-move-comments/ - https://plugins.svn.wordpress.org/copy-or-move-comments/ Notified WordPress: 2015-06-21...

WordPress Advertisement Management 1.0 Cross Site Scripting

Title: WordPress 'Advertisement Management' Plugin Version: 1.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-16 Download: - https://wordpress.org/plugins/advertisement-management/ - https://plugins.svn.wordpress.org/advertisement-management/ Notified WordPress: 2015-06-21...

Seawind Solution Bypass Admin Page Vulnerability

Exploit for php platform in category web applications Exploit Title : Seawind Solution Bypass Admin Page Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://india.seawindsolution.com/ Google Dork : intext:"Design & Developed By Seawind Solution Pvt.Ltd." Date:...

Welcart vulnerable to cross-site scripting

Overview Welcart provided by Collne Inc. is a WordPress plugin for creating shopping websites. Welcart contains a cross-site scripting CWE-79 vulnerability due to the processing of uscesreferer parameter in admin.php. Shoji Baba reported this vulnerability to IPA. JPCERT/CC coordinated with the...

WordPress Plugin Paid Memberships Pro Has Multiple Cross-Site Scripting Vulnerabilities

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. Multiple cross-site scripting vulnerabilities exist in the WordPress plugin Paid Memberships Pro. The vulnerability is caused by passin...

WordPress Plugin WP E-Commerce Shop Styling 2.5 - Arbitrary File Download

Title: Remote file download vulnerability in wordpress plugin wp-ecommerce-shop-styling v2.5 Author: Larry W. Cashdollar, @larry0 Date: 2015-07-05 Download Site: https://wordpress.org/plugins/wp-ecommerce-shop-styling Vendor: https://profiles.wordpress.org/haet/ Vendor Notified: 2015-07-05, fixed...