CVE-2019-10673

A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the...

CVE-2019-10673

A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the...

WordPress Ultimate Member 2.0.38 Cross Site Request Forgery

Exploit Title: WordPress Ultimate Member Plugin 2.0.38 CSRF Discovery Date: 03 / 05 / 2019 Discovered By: Georg Knabl Vendor Website: https://ultimatemember.com/ Software Link: https://wordpress.org/plugins/ultimate-member/ Software Download URL :...

CVE-2018-1822

IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296...

New Relic: Drupal admin takeover via install.php not being performed prior to install.

@grampae discovered an uninitialized Drupal instance running on one of our properties being hosted by a third party provider, an issue we've seen previously. To prevent this issue from surfacing again, we decommissioned the related domains and contacted the provider with details of the issue...

CVE-2017-1000493

Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover...

Rocket.Chat Server SQL Injection Vulnerability

Rocket.Chat Server is a Web-based open source online chat platform. A security vulnerability exists in Rocket.Chat Server 0.59 and earlier versions. An attacker can exploit the vulnerability to take control of the administrator account...

PHP Melody 2.7.3 - Multiple Vulnerabilities

PHP Melody 2.7.3 - Multiple Vulnerabilities Vulnerabilities Summary The following advisory describes three 3 vulnerabilities found in PHP Melody version 2.7.3. PHP Melody is a “self-hosted Video CMS which evolved over the last 9 years. SEO optimization, unbeaten security and speed are advantages...

Joomla! 3.6.4 - Admin TakeOver Exploit

Exploit for php platform in category web applications !/usr/bin/python3 CVE-2016-9838: Joomla! = 3.6.4 Admin TakeOver cf import bs4 import requests import random ADMINID = 384 url = 'http://vmweb.lan/Joomla-3.6.4/' formurl = url + 'index.php/component/users/?view=registration' actionurl = url +...

Joomla! 3.6.4 - Admin Takeover

Joomla! 3.6.4 - Admin Takeover !/usr/bin/python3 CVE-2016-9838: Joomla! = 3.6.4 Admin TakeOver cf Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution import bs4 import requests import random ADMINID = 384 url = 'http://vmweb.lan/Joomla-3.6.4/'...

Joomla! < 3.6.4 - Admin Takeover

!/usr/bin/python3 CVE-2016-9838: Joomla! = 3.6.4 Admin TakeOver cf Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution import bs4 import requests import random ADMINID = 384 url = 'http://vmweb.lan/Joomla-3.6.4/' formurl = url +...

Wordpress 2.6.1 - SQL Column Truncation Admin Takeover

...

Kayako eSupport 3.04.10 - XSS/CSRF Vulnerabilities

No description provided by source. + Exploit Title : kayako xss/xsrf Remote Vulnerabilities + Author : By D3V!L FUCKER + Script Link : http://www.kayako.com/solutions/esupport/ + Version : Kayako eSupport v3.04.10 + Tested on : linux ubuntu 9.10 + Code : +++++++++++++++++++++++++...

SEC Consult SA-20130904-0 :: GroupLink everything HelpDesk - undocumented password reset/admin takeover and XSS vulnerabilities

SEC Consult Vulnerability Lab Security Advisory 20130904-0 ======================================================================= title: Undocumented password reset and admin takeover & Cross-Site Scripting vulnerabilities product: GroupLink everything HelpDesk vulnerable version: =10.0.3 fixed...

Invision Power Board 1.x?2.x3.x - Admin Takeover

Invision Power Board 1.x?2.x3.x - Admin Takeover IPB Invision Power Board all versions 1.x? / 2.x / 3.x Admin account Takeover leading to code execution Written on : 2013/05/02 Released on : 2013/05/13 Author: John JEAN @johnjean on twitter Affected application: Invision Power Board = 3.4.4 Type ...

KubeLance 1.8.0 Cross Site Request Forgery / Cross Site Scripting

=========================================================== Vulnerable Software: KubeLance: 1.8.0 Official Site: kubelabs.com =========================================================== Vuln Desc: KubeLance: 1.8.0 suffers from multiple CSRF and XSS+HTML injection vulns. Below i'll show to you ONL...

Wordpress 2.6.1 (SQL Column Truncation) Admin Takeover Exploit

No description provided by source. !/usr/bin/php ?php ------------------------------------------------------------ quick'n'dirty wordpress admin-take0ver poc by iso^kpsbr in august 2oo8 works w/ wordpress 2.6.1 .oO private -- do not spread! Oo. you'll have to make sure you run roughly the same ph...

WordPress 2.6.1 - Admin Takeover (SQL Column Truncation)

WordPress 2.6.1 - Admin Takeover SQL Column Truncation !/usr/bin/php =5.2.1 you'll need to be as well, in case server is wp261php520 php-5.2.1/php createtables.php wp261php521 ------------------------------------------------------------- $BLOG = $SERVER'argv'1; echo "+ w0rdpress 2.6.1. admin...

WordPress Core 2.6.1 - Admin Takeover (SQL Column Truncation)

!/usr/bin/php =5.2.1 you'll need to be as well, in case server is wp261php520 php-5.2.1/php createtables.php wp261php521 ------------------------------------------------------------- $BLOG = $SERVER'argv'1; echo "+ w0rdpress 2.6.1. admin takeover, iso 0808\n"; if!$BLOG echo "! Usage:...

Wordpress 2.6.1 (SQL Column Truncation) Admin Takeover Exploit

Exploit for unknown platform in category web applications ============================================================== Wordpress 2.6.1 SQL Column Truncation Admin Takeover Exploit ============================================================== !/usr/bin/php =5.2.1 you'll need to be as well, in...