CVE-2019-9765

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

CVE-2019-9765

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

Cross site scripting

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

CVE-2019-9765

In Blogmini 1.0, XSS exists via the author name of a comment reply in the app/main/views.py articleDetails function, related to app/templates/articlecomments.html...

Simple Online Hotel Reservation System Cross Site Request Forgery

Exploit Title: Simple Online Hotel Reservation System - Cross-Site Request Forgery Add Admin Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 25, 2019 Vendor Homepage: https://code-projects.org/ Software Link :...

Advance Gift Shop Pro Script 2.0.3 - SQL Injection

Advance Gift Shop Pro Script 2.0.3 - SQL Injection Exploit Title: Advance Gift Shop Pro Script 2.0.3 - SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 21, 2019 Vendor Homepage: http://www.phpscriptsmall.com/ Software Link :...

Arbitrary Code Execution

wordpress is vulnerable to arbitrary code execution. The vulnerability exists in the wpattachedfile post meta entry when a user with author privilege passes a malicious image with exif metadata causing the Post Meta entry to change to an arbitrary substring such as a .jpg?file.php...

Virtual VCR Max .0a - .vcr Buffer Overflow (PoC)

Virtual VCR Max .0a - .vcr Buffer Overflow PoC !/usr/bin/python Exploit Title: VirtualVCR-Max .0a Overflow PoC Google Dork: N/A Date: 21/02/2019 Exploit Author: Wade Guest Vendor Homepage: http://virtualvcr.sourceforge.net/ Software Link: https://sourceforge.net/projects/virtualvcr/ Version: Max...

DEBIAN-CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

UBUNTU-CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

Remote code execution

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

CVE-2019-8942

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

Find a Place CMS Directory 1.5 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Find a Place CMS Directory 1.5 - 'assets/external/data2.php cate' SQL Injection Google Dork: inurl:"assets/external/data.php" Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me Vendor...

WordPress Core Local File Inclusion Remote Code Execution (CVE-2019-8942)

A remote code execution vulnerability exists in WordPress Core. Successful exploitation of this vulnerability could allow a remote attacker with at least author privileges to execute arbitrary code on the target server...

Listing Hub CMS 1.0 - pages.php id SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Listing Hub CMS 1.0 - 'pages.php id' SQL Injection Google Dork: inurl:"pages.php?title=privacy-policy" Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me Vendor Homepage:...

CVE-2019-8942: Unrestricted Upload of File with Dangerous Type

WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...

Critical Flaw Uncovered In WordPress That Remained Unpatched for 6 Years

Exclusive — If you have not updated your website to the latest WordPress version 5.0.3, it's a brilliant idea to upgrade the content management software of your site now. From now, I mean immediately. Cybersecurity researchers at RIPS Technologies GmbH today shared their latest research with The...

WordPress 5.0.0 Remote Code Execution

Impact Your browser does not support the video tag. An attacker who gains access to an account with at least author privileges on a target WordPress site can execute arbitrary PHP code on the underlying server, leading to a full remote takeover. We sent the WordPress security team details about...

WordPress Crop-image Shell Upload

This module exploits a path traversal and a local file inclusion vulnerability on WordPress versions 5.0.0 and use exploit/multi/http/wp/croprce msf undefinedcroprce show actions ...actions... msf undefinedcroprce set ACTION msf undefinedcroprce show options ...show and set options... msf...

Listing Hub CMS 1.0 - 'pages.php id' SQL Injection

Exploit Title: Listing Hub CMS 1.0 - 'pages.php id' SQL Injection Google Dork: inurl:"pages.php?title=privacy-policy" Date: 14 Feb 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me Vendor Homepage: https://themerig.com/ Software Link:...