5283 matches found
RSForm! Component for Joomla! 'lang' Parameter SQL Injection and Local File Include Vulnerabilities
The RSForm! Component for Joomla! is prone to an SQL-injection vulnerability and a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent...
Diferior 8.03 Cross Site Scripting
Vulnerability ID: HTB22721 Reference: http://www.htbridge.ch/advisory/storedxsscrosssitescriptingvulnerabilityindiferior.html Product: Diferior Vendor: Povilas Musteikis http://www.diferior.com/ Vulnerable Version: 8.03 and probably prior versions Vendor Notification: Vulnerability Type: Stored X...
Wernhart Guestbook 2001.03.28 - Multiple SQL Injections
Wernhart Guestbook 2001.03.28 - Multiple SQL Injections source: https://www.securityfocus.com/bid/45084/info Wernhart Guestbook is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues...
XSS vulnerability in Frog CMS
Vulnerability ID: HTB22684 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinfrogcms2.html Product: Frog CMS Vendor: Philippe Archambault http://www.madebyfrog.com/ Vulnerable Version: 0.9.5 and probably prior versions Vendor Notification: 09 November 2010 Vulnerability Type: XSS Cross...
SmartBox - 'page_id' SQL Injection
source: https://www.securityfocus.com/bid/45101/info SmartBox is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise the application, access or...
Web Crawler : Web Application Crawler - New Release
Web Crawler is a open source application that is based on the WebEngine library. WebEngine is the set of tools for performing black-box web-sites testing and other similar tasks. It provides tools means for reception of documents from a web-server, parse HTML pages, their comparisons, search...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Getsimple CMS 2.01 < 2.02 - Administrative Credentials Disclosure
Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548 download svn for 2.02beta: svn...
Drive-By Downloads Still Running Wild
For some time now, the browser has been the most dangerous piece of software on the Web, and to hear researchers tell it, the climate it likely to get far worse before it gets any better. The attack landscape has shifted in a lot of important ways in the last few years, but none of the changes ha...
Simea CMS - index.php SQL Injection
Simea CMS - index.php SQL Injection source: https://www.securityfocus.com/bid/44878/info Simea CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise t...
NSA: Our Development Methods Are in the Open Now
WASHINGTON–Despite its reputation for secrecy and technical expertise, the National Security Agency doesn’t have a set of secret coding practices or testing methods that magically make their applications and systems bulletproof. In fact, one of the agency’s top technical experts said that virtual...
Woltlab Burning Board 'locator.php' SQL Injection Vulnerability
Woltlab Burning Board is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in t...
Penetration Tester XSSer v1.0 - New Version Download
All of you web application penetration testers, check out this release of XSSer version 1.0! From this release, the author plans to rename XSSer to "The Mosquito". Our first post regarding XSSer can be found here. "XSSer is an open source penetration testing tool that automates the process of...
Joomla Forms Local File Inclusion / Download
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: Joomla Component comforms Multiple Vulnerabilities Date: 7-11-2010 Author: Th3 RDX Software Link: n/a Version: n/a Tested on: online Sites category: webapp/Joomla Code : n/a Google Dork :...
JAF CMS Multiple Remote File Include and Remote Shell Command Execution Vulnerabilities
JAF CMS is prone to an shell-command-execution vulnerability and multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input. An attacker can exploit the remote shell-command-execution issue to execute arbitrary shell commands in the context...
CommonSense CMS Sql Injection Vulnerability
Exploit Title: CommonSense CMS Sql Injection Vulnerability --- Platform / Tested on: Win/Linux --- category: webapps/0day --- Code : https://site/article.php?articleid=SQL --- Dork : "Powered by CommonSense CMS" --- Found this article interesting? Follow us on Twitter and LinkedIn to read more...
XSS in Textpattern CMS
Vulnerability ID: HTB22672 Reference: http://www.htbridge.ch/advisory/xssintextpatterncms.html Product: Textpattern CMS Vendor: Team Textpattern http://textpattern.com/ Vulnerable Version: 4.2.0 Vendor Notification: 21 October 2010 Vulnerability Type: XSS Cross Site Scripting Status: Fixed by...
LES PACKS - 'ID' SQL Injection
source: https://www.securityfocus.com/bid/44457/info LES PACKS is prone to an SQL-injection vulnerability. An attacker can exploit this SQL-injection issue to carry out unauthorized actions on the underlying database, which may compromise the application and aid in further attacks...
sNews CMS - Multiple Cross-Site Scripting Vulnerabilities
Vulnerability ID: HTB22638 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinsnews1.html Product: sNews Vendor: sNews Team tp://www.snewscms.com/ Vulnerable Version: 1.7 and probably prior versions Vendor Notification: 05 October 2010 Vulnerability Type: XSS Cross Site Scripting Status...
VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability (CVE-2010-2750)
VUPEN Security Research - Microsoft Office Word Document Array Indexing Vulnerability CVE-2010-2750 http://www.vupen.com/english/research.php I. BACKGROUND --------------------- Microsoft Office Word, included in the Microsoft Office suite, is a powerful authoring program that gives the ability t...