5456 matches found
OrangeHRM Cross Site Scripting / SQL Injection
I. Overview ======================================================== OrangeHRM Opensource 3.2.1, Professional & Enterprise 4.11 are prone to a multiple Blind SQL injection & XSS vulnerabilities. These vulnerabilities allows an attacker to inject SQL commands to compromise the affected database...
WordPress SP Project & Document Manager 2.5.3 - Blind SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: WordPress SP Project & Document Manager 2.5.3 Blind SQL Injection Google Dork: inurl:wp-content/plugins/sp-client-document-manager Date: 2015-03-04 Exploit Author: catsecurity Vendor Homepage: http://smartypantsplugins.com...
WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title : WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability Exploit Author : Claudio Viviani Vendor Homepage : https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/ Software Link :...
Balero CMS 0.7.2 - Multiple Blind SQL Injections
Balero CMS 0.7.2 - Multiple Blind SQL Injections Balero CMS v0.7.2 Multiple Blind SQL Injection Vulnerabilities Vendor: BaleroCMS Software Product web page: http://www.balerocms.com Affected version: 0.7.2 Summary: Balero CMS is an open source project that can help you manage the page of your...
Wordpress Traffic Analyzer Plugin 3.4.2 - Blind SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Wordpress plugin 'Traffic Analyzer' Blind SQL Injection Google Dork: inurl:/plugins/trafficanalyzer/js/ Date: 4/7/2015 Exploit Author: Dan King @fuzztester Vendor Homepage: http://wptrafficanalyzer.in/ Software Link:...
All In One WP Security & Firewall <= 3.9.0 - Blind SQL Injection
There are some pages which use the WordPress escsql function incorrectly. PoC http://www.example.com/wp-admin/admin.php?page=aiowpsec=tab3=userid,select from selectsleep30a=asc...
WordPress All In One WP Security And Firewall 3.9.0 SQL Injection
Exploit Title : WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability Exploit Author : Claudio Viviani Vendor Homepage : https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/ Software Link :...
All In One WP Security & Firewall <= 3.9.0 - Blind SQL Injection
There are some pages which use the WordPress escsql function incorrectly. http://www.example.com/wp-admin/admin.php?page=aiowpsec&tab=tab3&orderby=userid,select from selectsleep30a&order=asc...
u-Auctions - Multiple Vulnerabilities
u-Auctions - Multiple Vulnerabilities Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This vulnerability affects...
u-Auctions - Multiple Vulnerabilities
Exploit Title: u-Auctions Multiple Vulnerabilities Google Dork: "Powered by u-Auctions ©" Date: 03 April 2015 Exploit Author: Don Vendor Homepage: https://www.u-auctions.com / Version: ALL Tested on: Debian 1. Blind SQL injection: This vulnerability affects /adsearch.php URL encoded POST input...
SP Project & Document Manager <= 2.5.3 - Blind SQL Injection
The SP Project & Document Manager WordPress plugin was affected by a Blind SQL Injection security vulnerability. PoC http://www.example.com/wp-content/plugins/sp-client-document-manager/ajax.php?function=thumbnails=SQLi...
SP Project Document Manager <= 2.5.3 - Blind SQL Injection
The SP Project & Document Manager WordPress plugin was affected by a Blind SQL Injection security vulnerability...
WordPress SP Project & Document Manager Plugin 2.5.3 - Blind SQL Injection
SP Project & Document Manager plugin is prone to a blind SQL injection that is in the thumbnails function location: /wp-content/plugins/sp-client-document-manager/ajax.php. Solution Upgrade the plugin...
SP Project & Document Manager <= 2.5.3 - Blind SQL Injection
The SP Project & Document Manager WordPress plugin was affected by a Blind SQL Injection security vulnerability. http://www.example.com/wp-content/plugins/sp-client-document-manager/ajax.php?function=thumbnails&pid=SQLi...
Live Forms - Visual Form Builder 3.0.1 - Blind SQL Injection
The AJAX action ‘getreqlist’ is available to all logged in users. The parameter ‘ipp’ sent to this action is vulnerable to Blind MySQL Injection. This can be leveraged by detecting how long a query takes to return...
WordPress Live Forms Plugin <= 3.0.1 - Blind SQL Injection
Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Solution Update the plugin...
Gravity Forms 1.8 <= 1.9.3.5 - Authenticated Blind SQL Injection
Title: Gravity Forms 1.8 = 1.9.3.5 - Blind SQL Injection CVE-2015-2260 Version/s Tested: 1.9.3.1 Description: Gravity Forms is one of the most popular WordPress plugins gravityforms used to create forms for WordPress sites. The latest version at the time of writing 1.9.3.5 contains an authenticat...
WordPress Plugin SEO by Yoast 1.7.3.3 - Blind SQL Injection
WordPress Plugin SEO by Yoast 1.7.3.3 - Blind SQL Injection Title: WordPress SEO by Yoast = 1.7.3.3 - Blind SQL Injection Version/s Tested: 1.7.3.3 Patched Version: 1.7.4 CVSSv2 Base Score: 9 AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2 Temporal Score: 7...
Pods 1.4.7 <= 2.5.1.1 - Blind SQL Injection
Version/s Tested: 2.5.1.1 and previous Description: Pods is a popular custom content types and fields plugin for WordPress. In the PodsUI class, which is used to build Pods administration interfaces, the orderby SQL query is set via a GET variable, which was not properly sanitized. Technical...