758 matches found
Sql injection
The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...
CVE-2017-7626
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php nart,type in GET Method...
CVE-2017-7627
The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php there is a missing JEXEC check...
CVE-2017-7628
The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...
Type confusion
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php nart,type in GET Method...
Design/Logic Flaw
The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php there is a missing JEXEC check...
CVE-2017-7628
The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...
CVE-2017-7626
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php nart,type in GET Method...
CVE-2017-7628
The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...
CVE-2017-7626
The CVE-2017-7626 entry concerns the Joomla! ecosystem: the Smart related articles extension 1.1 for Joomla! contains a cross-site scripting (XSS) vulnerability in dialog.php, triggered via parameters n_art and type in the GET method. The issue is documented across sources (NVD entry and CNVD/CVE...
CVE-2017-7627
The CVE-2017-7627 issue concerns the Joomla! extension “Smart related articles” (version 1.1). The root cause is a missing _JEXEC check in dialog.php, which permits direct requests bypassing proper initialization. Affected software is the Smart related articles extension for Joomla!, exposing a p...
Symphony Cross-Site Scripting Vulnerability
Symphony is a content management system CMS developed using PHP and MySQL. The system supports search engine optimization, module extensions and more. A cross-site scripting vulnerability exists in the publish/articles/new/ URI in Symphony version 2.6.11. A remote attacker can exploit this...
Apple Releases Multiple Security Updates
Apple has released security updates for several products to address multiple vulnerabilities. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the following Apple Support Articles...
Smart related articles ,1.1,SQL Injection and XSS
Smart related articles by Iacopo Guarneri, 1.1,SQL Injection and XSS...
Easy Support Tools 1.0 SQL Injection
Exploit Title: Easy Support Tools - FAQs, Help Articles, Blog and Feedback Script v1.0 - SQL Injection Google Dork: N/A Date: 07.02.2017 Vendor Homepage: http://nelliwinne.net/ Software Buy: https://codecanyon.net/item/easy-support-tools-faqs-help-articles-blog-and-feedback/17864522 Demo:...
WordPress REST API content injection vulnerability
1.漏洞信息： WordPress是一个以PHP和MySQL为平台的自由开源的博客软件和内容管理系统。在4.7.0版本后，REST API插件的功能被集成到WordPress中,由此也引发了一些安全性问题。近日，一个由REST API引起的影响WorePress4.7.0和4.7.1版本的漏洞被披露，该漏洞可以导致WordPress所有文章内容可以未经验证被查看，修改，删除，甚至创建新的文章，危害巨大。 2.漏洞影响版本： WordPress 4.7.0 WordPress 4.7.1 3.复现环境: Apache2.4 PHP 7.0 WordPress 4.7.1 4.复现过程:...
Home of Viral Images_ Videos and Articles Script - SQL Injection
Vulnerability: SQL Injection Date: 19.01.2017 Vendor Homepage: http://www.scriptfolder.com/ Script Name: Home of Viral Images, Videos and Articles Script Script Buy Now: http://www.scriptfolder.com/viralzone-home-of-viral-images-videos-and-articles/ Author: Ihsan Sencan Author Web: http://ihsan.n...
Five Ways That Good Guys Share More Than Bad Guys
It takes a lot for me to write a cybersecurity blog post these days. I spend most of my writing time working on my PhD. Articles like Nothing Brings Banks Together Like A Good Hack drive me up the wall, however, and a Tweet rant is insufficient. What fired me up, you might ask? Please read the...
Zarafe CMS 1.0 Cross Site Scripting
Exploit Title : Zarafe CMS 1.0 / Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.zarrafeh.net/ Category: Webapps Tested on: Win Version: 1.0 Date: 2016/08/27 PoC: GET = /productview.php?productid=XSS GET = /articles.php?articleid=XSS Payload : 7b084"Only For...
