5357 matches found
Mantis 0.x/1.0 view_all_set.php Multiple Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/16657/info Mantis is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize...
CLUB Nuke 2.0 - Multiple SQL-Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19442/info CLUB-Nuke is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. A successful exploit could allow an attacker to compromise...
Ocean12 Technologies Calendar Manager Pro 1.0 1 admin/main.asp date Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/17877/info Calendar Manager Pro is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to...
Lussumo Vanilla 1.0 RootDirectory Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/19127/info Vanilla is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP...
OpenAutoClassifieds <= 1.5.9 SQL Injection Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/36173/info OpenAutoClassifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attack...
Bedeng PSP 1.1 index.php a.nsub Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/15583/info Bedeng PSP is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. Successful exploitation could...
RunCMS 1.6 - Remote Blind SQL Injection Exploit (IDS evasion)
No description provided by source. // / RUNCMS 1.6 BLIND SQL Injection Exploit + IDS evasion / // / exploit get hash of admin password / / / / Exploit is invisible for / / RUNCMS sql injection detecting mechanism / // // / tested on RUNCMS english version 1.6 / // // / Date of Public EXPLOIT:...
Early Impact ProductCart 2.6/2.7 viewPrd.asp idcategory Parameter SQL Injection
No description provided by source. source: http://www.securityfocus.com/bid/13881/info ProductCart is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...
Pixie CMS 1.01 - 1.04 - Blind SQL Injections
No description provided by source. Exploit Title: Pixie CMS 1.01 - 1.04 pixieuser Blind SQL Injection Google Dork: None Date: 11/14/2011 Author: Piranha, piranhaattorontomail.com Software Link: http://www.getpixie.co.uk/ Version: 1.01 - 1.04 Tested on: Windows XP SP3, Pixie versions: 1.01 - 1.04...
OWASP Mantra Security Toolkit - Browser Based Security Framework
OWASP Mantra is a collection of free and open source tools integrated into a web browser, which can become handy for students, penetration testers, web application developers,security professionals etc. It is portable, ready-to-run, compact and follows the true spirit of free and open source...
PHPOK SQL注射漏洞（官网）
简要描述： 参数过滤不严导致sql注入 详细说明： 测试官网OK http://www.phpok.com/api.php?c=api&f=phpok&id=sublist¶mpid=1%20union%20select%20VERSION,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33%20union%20select%20%20from%20qingganproject%20where%200 漏洞证明：...
Khan Academy: Unchecking hidden parameter is vulnerable to XSS-attack
Unchecking parameter Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. http://crowdin.khanacademy.org:/login PoC prompt986874"/...
User Cake - Cross-Site Request Forgery
User Cake - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/67604/info User Cake is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests. An attacker can exploit this issue to perform unauthorized actions in the context of a...
PHP-Nuke 'Submit_News' Component - SQL Injection
source: https://www.securityfocus.com/bid/67656/info PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue to compromise the application, access or modify data, or exploi...
w3af - Open Source Web Application Security Scanner
w3af , is a Web Application Attack and Audit Framework. The w3af core and it’s plugins are fully written in python, it identifies more than 200 vulnerabilities and reduce your site’s overall risk exposure. Identify vulnerabilities like SQL Injection, Cross-Site Scripting, Guessable credentials,...
CVE-2013-6454
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute...
Acunetix Web Vulnerability Scanner Version 9 - Web Application Security Testing Tool
Acunetix W eb V ulnerability S canner WVS is an automated web application security testing tool that audits your web applications by checking for exploitable hacking vulnerabilities. Automated scans may be supplemented and cross-checked with the variety of manual tools to allow for comprehensive...
Oracle / Sun / MySQL / PeopleSoft / OpenJDK applications multiple security vulnerabilities
Quarterly update fixes 144 different vulnerabilities...
Use of the referrer header on the error page for Crucible can enable XSS attacks
If the referrer header is manipulated and an error condition is triggered, the user will be displayed the error page in FeCru, which includes the manipulated referrer value on the page as a link. The use of the referrer header value directly as the target of a hyperlink can result in the user...
StopTheHacker: Reflected cross site scripting in login page
It was observed that the application is vulnerable to cross-site scripting XSS. XSS is a type of attack that involves running a malicious scripts on a victim’s browser. Once exploited It is possible to steal or manipulate a legitimate user’s session credentials including session cookies. Request ...