9335 matches found
ZeusCart 4.0 - SQL Injection
ZeusCart 4.0: SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclosed ...
ZeusCart 4.0 SQL Injection
ZeusCart 4.0: SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: ZeusCart 4.0 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: [email protected] Vulnerability Type: SQL Injection Remote Exploitable: Yes Reported to vendor: 08/13/2015 Disclosed ...
WordPress media-file-manager-advanced Plugin Multiple Vulnerabilites
No description provided by source. Post Delete http://domain.tld/wp-admin/admin-ajax.php?action=mfmarelocatordelete post: id=17 MKDIR http://domain.tld/wp-admin/admin-ajax.php?action=mfmarelocatormkdir newdir=EVEXFOLDER folder exists: http://domain.tld/wp-contents/uploads/EVEXFOLDER RMDIR Dir Mus...
Synology Video Station 1.5-0757 - Multiple Vulnerabilities
Synology Video Station 1.5-0757 - Multiple Vulnerabilities ------------------------------------------------------------------------ Synology Video Station command injection and multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Han Sahi...
Synology Video Station 1.5-0757 - Multiple Vulnerabilities
------------------------------------------------------------------------ Synology Video Station command injection and multiple SQL injection vulnerabilities ------------------------------------------------------------------------ Han Sahin, September 2015...
Qlikview 11.20 SR11 - Blind XML External Entity Injection
Qlikview 11.20 SR11 - Blind XML External Entity Injection Exploit Title: Qlikview blind XXE security vulnerability Product: Qlikview Vulnerable Versions: v11.20 SR11 and previous versions Tested Version: v11.20 SR4 Advisory Publication: 08/09/2015 Latest Update: 08/09/2015 Vulnerability Type:...
Qlikview 11.20 SR4 Blind XXE Injection
Exploit Title: Qlikview blind XXE security vulnerability Product: Qlikview Vulnerable Versions: v11.20 SR11 and previous versions Tested Version: v11.20 SR4 Advisory Publication: 08/09/2015 Latest Update: 08/09/2015 Vulnerability Type: Improper Restriction of XML External Entity Reference CWE-611...
Cyberoam - Blind SQL Injection
Description The username field in the captive portal of Cyberoam NG firewall is vulnerable to SQL Injection and can be exploited to execute sql commands on the database. The username field is vulnerable to the following types of SQL Injections a Boolean-based blind sql injection b Stacked...
Serendipity 2.0.1 Blind SQL Injection
Serendipity 2.0.1: Blind SQL Injection Security Advisory – Curesec Research Team 1. Introduction Affected Product: Serendipity 2.0.1 Fixed in: 2.0.2 Fixed Version Link: https://github.com/s9y/Serendipity/releases/download/2.0.2/serendipity-2.0.2.zip Vendor Contact: [email protected]...
ResourceSpace CMS 7.3.7009 SQL Injection Vulnerability
ResourceSpace CMS versions 7.3.7009 and below suffer from a remote SQL injection vulnerability. Title: Blind boolean sql injection vulnerability in ResourceSpace CMS Author: William F. Reyor III Contact: email protected Published: August 22 2015 Vendor: Montala Limited Vendor url:...
GigPress <= 2.3.10 - Authenticated XSS & Blind SQLi
The GigPress WordPress plugin was affected by an Authenticated XSS & Blind SQLi security vulnerability...
WordPress 404 to 301 Plugin <= 2.0.2 - Blind SQL Injection
Because of this vulnerability, authenticated administrators can execute arbitrary SQL commands. Solution Update the plugin...
WordPress WP Symposium Plugin 15.1 - Blind SQL Injection Vulnerability
Exploit for php platform in category web applications Details ================ Software: WP Symposium Version: 15.1 Homepage: https://wordpress.org/plugins/wp-symposium Advisory report:...
CodoForum 3.3.1 - Multiple SQL Injection Vulnerabilities
Exploit for php platform in category web applications CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team http://blog.curesec.com/article/blog/CodoForum-331-Multiple-SQL-Injection-Vulnerabilities-42.html 1. Introduction Affected Product: CodoForum 3.3...
WordPress Plugin WP Symposium 15.1 - Blind SQL Injection
WordPress Plugin WP Symposium 15.1 - Blind SQL Injection Details ================ Software: WP Symposium Version: 15.1 Homepage: https://wordpress.org/plugins/wp-symposium Advisory report:...
WordPress Plugin WP Symposium 15.1 - Blind SQL Injection
Details ================ Software: WP Symposium Version: 15.1 Homepage: https://wordpress.org/plugins/wp-symposium Advisory report: https://security.dxw.com/advisories/blind-sql-injection-in-wp-symposium-allows-unauthenticated-attackers-to-access-sensitive-data/ CVE: Awaiting assignment CVSS: 6.4...
BigTree CMS 4.2.3 - (Authenticated) SQL Injection
BigTree CMS 4.2.3 - Authenticated SQL Injection BigTree CMS 4.2.3: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team Online-Reference: http://blog.curesec.com/article/blog/BigTree-CMS-423-Multiple-SQL-Injection-Vulnerabilities-39.html 1. Introduction Affected Produc...
CodoForum 3.3.1 - Multiple SQL Injections
CodoForum 3.3.1: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team http://blog.curesec.com/article/blog/CodoForum-331-Multiple-SQL-Injection-Vulnerabilities-42.html 1. Introduction Affected Product: CodoForum 3.3.1 Fixed in: 3.4 Fixed Version Link:...
Love fast router web Management page several vulnerabilities SQL blind injection, the plaintext stored passwords-bug warning-the black bar safety net
SQL blind injection, you can bypass the web page login authentication login default user name is admin. Password admin） I tested the ip is 1 9 2. 1 6 8. 1 6 8. 1:8 0,blind the url is http://192.168.168.1/login/x The user name of the payload is -1" OR 321=6 AND 0 0 0 1 6 7=0 0 0 1 6 7 -- The...