Arbitrary shell execution

Security Advisory This release contains a fix for a security advisory related to the improper handling of shell commands Uses of shellexec and exec were not escaping filenames and configuration settings in most cases A properly crafted filename or configuration option would allow for arbitrary co...

Joomla! Component BookLibrary 3.6.1 - SQL Injection

Exploit Title: Joomla! Component BookLibrary v3.6.1 - SQL Injection Google Dork: inurl:index.php?option=combooklibrary Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy: https://extensions.joomla.org/extensions/extension/living/education-a-culture/booklibrary-basic/ Demo:...

Joomla! Component BookLibrary 3.6.1 - SQL Injection

Joomla! Component BookLibrary 3.6.1 - SQL Injection Exploit Title: Joomla! Component BookLibrary v3.6.1 - SQL Injection Google Dork: inurl:index.php?option=combooklibrary Date: 22.02.2017 Vendor Homepage: http://ordasoft.com/ Software Buy:...

UBUNTU-CVE-2016-4861

The 1 order and 2 group methods in ZendDbSelect in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...

CVE-2015-8831

Cross-site scripting XSS vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web script or HTML via the author name in a comment...

Rockstar Games: <- Critical IDOR vulnerability in socialclub allow to insert and delete comments as another user and it discloses sensitive information ->

In this report, the researcher found an insecure direct object reference that allowed a malicious user to impersonate another user in the comment section under Newswire articles. This meant that an attacker could leave abusive comments that appeared to have been made by another user, or delete a...

Serendipity Cross-Site Request Forgery Vulnerability (CNVD-2017-00771)

Serendipity is a PHP-based blogging system developed by Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site request forgery vulnerability exists in the comment.php page in Serendipity 2.0.5 and earlier versions, which allows attackers to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...

CVE-2017-5494

Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...

Cross site request forgery (csrf)

comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

CVE-2016-7966

Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. Due to the parser used on the URL it was not possible to include the equal sign = or a space into the injected HTML, which greatly reduces the available HTML functionality...

Shopify: Stored XSS in blog comments through Shopify API

Hi there! As far I understand the Shopify Shop have blogs which allow users to comment on blog posts, however the comments with HTML content automatically gets sanitised and then posted to avoid XSS issue. However using the API for comment modification, any application with comment permission can...

Mezzanine 4.2.0 - Cross-Site Scripting

Mezzanine 4.2.0 - Cross-Site Scripting Security Advisory - Curesec Research Team 1. Introduction Affected Product: Mezzanine 4.2.0 Fixed in: 4.2.1 Fixed Version Link: https://github.com/stephenmcd/mezzanine/releases/tag/4.2.1 Vendor Website: http://mezzanine.jupo.org/ Vulnerability Type: XSS Remo...

bismilhaber.com XSS vulnerability

Vulnerable URL: http://www.bismilhaber.com/xcommentpage.php?jsoncallback=prompt/OPENBUGBOUNTY/...

ilkehaber.com XSS vulnerability

Vulnerable URL: http://www.ilkehaber.com/xcommentpage.php?jsoncallback=prompt/OPENBUGBOUNTY/...

X (Formerly Twitter): [IDOR][translate.twitter.com] Opportunity to change any comment at the forum

POC: https://translate.twitter.com/forum/getting-started/topics/7037/posts/43287/edit Steps to reproduce: 1 Go to any forums topic for example: https://translate.twitter.com/forum/getting-started/topics/7037 2 View source code of the page and take post id screenshot "idor edit.jpg" 3 Append...

4images 1.7.13 SQL Injection

vulnerable app : 4images query$sql; Input parameter orderby is not sanitized before being passed to the sql query which lead to sql injection flaw POC GET /lab/4images1.7.13/4images/admin/validateimages.php?action=validateimages&orderby=extractvalue1,concat0x7e,version&direction=ASC&limitnumber=1...