5007 matches found
CVE-2012-6691
osCMax prior to 2.5.1 contains multiple CSRF vulnerabilities in the admin panel that allow an attacker to hijack administrator sessions and perform SQL injection via the status parameter in admin/stats_monthly_sales.php or the country parameter in admin/create_account_process.php. Root cause is i...
csrf添加管理员
简要描述： rt 详细说明： 版本:phpshe1.3最新版。其他版本没有测试，请自查 后台管理列表，添加管理员表单没有token导致csrf 漏洞证明： 不想录视频了。我提供代码你们自己测下。 None...
Shopify: Notification request disclose private information about other myshopify accounts
Hello Attacker, using notification feature in Admin panel, can successfully disclose\enumerate Shopify customers and retrieve their user-id, first+last name and email address. Last part of information is most avluble piece of information, since it can be used to conduct targeted attack on Shopify...
AfterLogic WebMail Lite Authentication Bypass
AfterLogic WebMail Lite is a free web-based IMAP and SMTP email-client with Ajax interface. AfterLogic WebMail Lite is available for both PHP and ASP.NET platforms. The version of AfterLogic WebMail Lite that is written in PHP is free and open-source software subject to the terms of the Affero...
WordPress plugin Google Analytics by Yoast stored XSS vulnerability-vulnerability warning-the black bar safety net
WordPress famous plugin Google Analytics by Yoast plug-in exposed storage-typeXSSvulnerability that can allow unauthorized attackers in the WordPress admin panel to store any HTML code, including JavaScript. The administrator to view the plugin Settings panel is a JavaScript will be triggered, do...
Unasjee CMS Cross Site Request Forgery
. | | / | | \ \ | | \ / | |\ / / /\ \ / \ | Y / ^ / / || / / / / /\ /\ \ \ \ | / \ / / \ | \ \ / // / \ / / / / UNASJEE CMS - Admin Panel CSRF Vulnerability PoC Exploits My + Discovered by: KnocKout Contact : [email protected] HomePage : http://h4x0resec.blogspot.com Greetz:...
CVE-2015-2289
Cross-site scripting XSS vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipitycatname parameter to serendipityadmin.php, when creating a new category...
Smart PHP Poll - Auth Bypass Vulnerability
Exploit for php platform in category web applications Exploit Title: Smart PHP Poll Auth Bypass Vulnerability Google Dork: Copyright Smart PHP Poll. All Rights Reserved. Exploit Author: Mr.tro0oqy from Yemen Email : email protected Download Script...
Mambo 4.6.5 Cross Site Request Forgery / SQL Injection
Affected software: Mambo Type of vulnerability: csrf to sql injection URL: http://source.mambo-foundation.org/ Discovered by: Provensec Website: http://www.provensec.com version 4.6.5 Proof of concept no csrf token were used on sql query form so attacker can leverage csrf to execute sql query on...
osCommerce 2.3.4 - SQL Injection & Stored XSS Vulnerabilities
Exploit for php platform in category web applications Title: osCommerce 2.3.4 - SQL Injection & Stored XSS Date: 13.03.15 Affected versions: = 2.3.4 latest atm Vendor: oscommerce.com Tested on: Apache 2.2 / PHP 5.3 @ linux Contact: smash at devilteam.pl As disclosed before, you may create new...
CVE-2015-1562
Multiple cross-site scripting XSS vulnerabilities in Saurus CMS 4.7.0 allow remote attackers to inject arbitrary web script or HTML via the 1 search parameter to admin/usermanagement.php, 2 datasearch parameter to /admin/profiledata.php, or 3 filter parameter to errorlog.php...
WordPress Acobot Live Chat And Contact Form 2.0 CSRF / XSS
Title: WordPress 'Acobot Live Chat & Contact Form' CSRF/XSS Version: 2.0 Author: Morten Nørtoft, Kenneth Jepsen, Mikkel Vej Date: 2015/01/26 Download: https://wordpress.org/plugins/acobot/ Contacted WordPress: 2015/01/26 ========================================================== Plugin descriptio...
After Logic Mail - Remote Admin Takeover (All versions)
AfterLogic WebMail Lite is a free web-based IMAP and SMTP email-client with Ajax interface. AfterLogic WebMail Lite is available for both PHP and ASP.NET platforms. The version of AfterLogic WebMail Lite that is written in PHP is free and open-source software subject to the terms of the Affero...
WordPress Plugin Blubrry PowerPress Podcast 'admin.php' Cross-Site Scripting Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Blubrry PowerPress Podcast 'admin.php' due to the program...
WordPress Photo Gallery 1.2.8 XSS / SQL Injection Vulnerabilities
WordPress Photo Gallery plugin version 1.2.8 suffers from a cross site scripting and remote SQL injection vulnerabilities CVE-2015-1394 Photo Gallery Wordpress Plugin - Multiple XSS Vulnerabilities Version 1.2.8 ---------------------------------------------------------------- Product Information:...
Restaurantbiller SQL Injection / Shell Upload
=================================================================================== + TITLE : Restaurantbiller Multiple Vulnerabilities + VENDOR : http://www.demo.restaurantbiller.com/ + VERSION : - + AUTHOR : R3vanBastard + TESTED ON : Windows + DORK : "Powered by Restaurant Biller"...
ecommerceMajor SQL Injection Vulnerability
ecommerceMajor suffers from remote SQL injection vulnerabilities. Exploit Title : ecommercemajor ecommerce CMS SQL Injection and Authentication bypass Author : Manish Kishan Tanwar Home page Link : https://github.com/xlinkerz/ecommerceMajor Date : 22/01/2015 Discovered at : IndiShell Lab Love to ...
ecommerceMajor - SQL Injection Authentication Bypass
ecommerceMajor - SQL Injection Authentication Bypass Exploit Title : ecommercemajor ecommerce CMS SQL Injection and Authentication bypass Author : Manish Kishan Tanwar Home page Link : https://github.com/xlinkerz/ecommerceMajor Date : 22/01/2015 Discovered at : IndiShell Lab Love to : zero...
CVE-2015-1058
Multiple cross-site scripting XSS vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dataCategorytitle parameter to admin/categories/add, 2 dataFieldtitle parameter to admin/fields/ajaxfields/, 3 name property in a basicInfo JSON object to...