3996 matches found
Internet Photoshow - 'login_admin' Parameter Unauthorized Access Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/29227/info Internet Photoshow is prone to a vulnerability that can result in unauthorized database access. Attackers can exploit this issue to gain administrative access to the application. Internet Photoshow Special...
Visible Systems Razor 4.1 Password File Vulnerability (1)
No description provided by source. source: http://www.securityfocus.com/bid/1424/info The Razor Configuration Management program stores passwords in an insecure manner. A local attacker can obtain the Razor passwords, and either seize control of the software and relevant databases or use those...
Joomla! 1.6 - Multiple SQL Injection Vulnerabilities
No description provided by source. Source: http://www.securityfocus.com/bid/46846/info Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to...
Wordpress plugin Ripe HD FLV Player SQL Injection Vulnerability
No description provided by source. ------------------------------------------------------------------- Wordpress plugins - ripe-hd-player FD/SQL Injection Vulnerability ------------------------------------------------------------------- Vendor: http://www.hitasoft.com/products.php Author = Zikou-...
JFFNMS 0.8.3 admin/adm/test.php PHP Information Disclosure
No description provided by source. source: http://www.securityfocus.com/bid/24414/info Just For Fun Network Management and Monitoring System JFFNMS is prone to multiple remote vulnerabilities, including a cross-site scripting issue, an SQL-injection issue, and multiple information-disclosure...
deV!L`z Clanportal Witze Addon 0.9 - SQL Injection Vulnerability
No description provided by source. ======================================================================================== | Title : deV!Lz Clanportal Witze Addon Versions 0.9 SQL Injection Vulnerability | Author : Easy Laster | Download : http://dzcp-zone.de/downloads/?action=show&id=97 | Scrip...
PHPNuke 5.x/6.x Web_Links Module Remote SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/7558/info It has been reported that multiple input validation bugs exist in the WebLinks module used by PHPNuke. Because of this, a remote user may be able to access the database and potentially gain access to sensitive...
PHPWebThings 1.4 Download.PHP File Parameter SQL Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/15399/info phpWebThings is prone to an SQL injection vulnerability. This is an input validation issue related to data that will be used in SQL queries, allowing a remote user to influence the structure and logic of a quer...
Joomla com_niceajaxpoll <= 1.3.0 - SQL Injection Vulnerability
No description provided by source. Title : Joomla comniceajaxpoll = 1.3.0 SQL Injection Vulnerability Author : Patrick de Brouwer - @knickz0r NLSecurity - www.nlsecurity.org Dork : inurl:/index.php?option=comniceajaxpoll Software : Joomla component Nice Ajax Poll = 1.3.0...
Crowd User Directory application password stored in plain text
Table: cwddirectoryattribute Column: attributevalue How to Verify in my environment: Connect to JIRA database using psql and run query: code select attributevalue from cwddirectoryattribute where attributename = 'application.password' code Note how the returned value is the plain text value of th...
云人才系统SQL注入，绕过WAF
简要描述： 云人才系统SQL注入，绕过WAF 详细说明： 云人才系统SQL注入，绕过了360的WAF 首先需要注册一个普通用户 比如官方演示站点： 然后来到 http://www.hr135.com/member/index.php?M=index&C=info 可以看到有某数字的WAF： 于是我们发现代码如下： function infoaction if$POST"submitBtn" $POST=$this-posttrim$POST; if$POST"name"=="" $this-obj-ACTmsg"index.php?C=info","��������Ϊ�գ�";...
Crime24 Stealer Panel 1.0 - Multiple Vulnerabilities
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= | \ | | | \ | | | |/ | / | | | | |/ / \ | | | |/ | ' \ | || | | | \ \ || | Twitter @TheHackersBay Pentester / Underground hacker Exploit Title: Crime24 Stealer Panel &in=1&search=Search Example: http://i.imgur.com/zyIr5xv.png...
Jigowatt PHP Event Calendar "year" SQL注入漏洞
Jigowatt PHP Event Calendar是一款日历WEB应用程序。 Jigowatt PHP Event Calendar calendar/dayview.php不正确过滤"year"参数数据，允许远程攻击者利用漏洞提交特制的SQL查询，操作或获取数据库数据。 0 Jigowatt PHP Event Calendar 2.x 目前没有详细解决方案： http://codecanyon.net/item/php-event-calendar/47723...
CVE-2014-1986
The Content Provider in the KOKUYO CamiApp application 1.21.1 and earlier for Android allows attackers to bypass intended access restrictions and read database information via a crafted application...
Jigowatt PHP Event Calendar - 'day_view.php' SQL Injection
source: https://www.securityfocus.com/bid/66923/info Jigowatt PHP Event Calendar is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, acces...
MobFox mAdserve SQL注入漏洞
Bugtraq ID:66661 MobFox mAdserve是一款基于WEB的广告服务应用。 MobFox mAdserve存在一个SQL注入漏洞，允许远程攻击者利用漏洞提交特制的SQL查询，操作或获取数据库数据。 0 MobFox mAdserve 2.0 目前没有详细解决方案： http://www.madserve.org/...
Procentia IntelliPen 1.1.12.1520 - 'data.aspx' Blind SQL Injection
CVE: CVE-2014-2043 Vendor: Procentia Product: IntelliPen Affected version: 1.1.12.1520 Fixed version: 1.1.18.1658 Reported by: Jerzy Kramarz Details: SQL injection has been found and confirmed within the software as an authenticated user. A successful attack could allow an authenticated attacker ...
Multiple Vulnerabilities in Eventum
High-Tech Bridge Security Research Lab discovered vulnerability in Eventum, which can be exploited to reinstall and compromise vulnerable application. 1 Incorrect Default Permissions in Eventum: CVE-2014-1631 The vulnerability exists due to incorrect default permission set for installation script...
Etoshop B2B Vertical Marketplace Creator - Multiple SQL Injections
source: https://www.securityfocus.com/bid/64332/info B2B Vertical Marketplace Creator is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit these issues by manipulating the SQL quer...
Dynamic Biz Website Builder (QuickWeb) 1.0 - '/apps/news-events/newdetail.asp?id' SQL Injection
source: https://www.securityfocus.com/bid/64371/info EtoShop Dynamic Biz Website Builder QuickWeb is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. An attacker can exploit these issues by manipulating...