VoHo Concept4E CMS v1.0 - SQL Injection Vulnerabilities

Document Title: =============== VoHo Concept4E CMS v1.0 - SQL Injection Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1816 Release Date: ============= 2016-04-06 Vulnerability Laboratory ID VL-ID: ==================================== 18...

WordPress Plugin IMDb Profile Widget 1.0.8 - Local File Inclusion

WordPress Plugin IMDb Profile Widget 1.0.8 - Local File Inclusion Exploit Title: Wordpress Plugin IMDb Profile Widget - Local File Inclusion Exploit Author: CrashBandicot @DosPerl Date: 2016-03-26 Google Dork : inurl:/wp-content/plugins/imdb-widget Vendor Homepage:...

Joomla iCagenda 3.5.15 Cross Site Scripting

Exploit Title : Joomla iCagenda Cross Site Scripting Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/calendars-a-events/icagenda Google Dork : inurl:index.php?option=comicagenda Date: 2016/03/22 Version: 3.5.5 up to 3.5.15 Payload : " Demo...

Joomla! Component Easy Youtube Gallery 1.0.2 - SQL Injection

Joomla! Component Easy Youtube Gallery 1.0.2 - SQL Injection Exploit Title : Joomla Easy Youtube Gallery 1.0.2 SQL Injection Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/easy-youtube-gallery Google Dork : inurl:comeasyyoutubegallery...

WordPress Brandfolder 3.0 Plugin - Remote File Inclusion / Local File Inclusion

Exploit for php platform in category web applications Exploit Title: Wordpress brandfolder plugin / RFI & LFI Google Dork: inurl:wp-content/plugins/brandfolder Date: 03/22/2016 Exploit Author: AMAR^SHG Vendor Homepage: https://brandfolder.com Software Link:...

Joomla Easy YouTube Gallery 1.0.2 - SQL Injection

Exploit for php platform in category web applications Exploit Title : Joomla Easy Youtube Gallery 1.0.2 SQL Injection Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/easy-youtube-gallery Google Dork : inurl:comeasyyoutubegallery mycategory...

WordPress Abtest Plugin- Local File Inclusion

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Abtest - Local File Inclusion Date: 2016-03-19 Google Dork : inurl:/wp-content/plugins/abtest/ Exploit Author: CrashBandicot Vendor Homepage: https://github.com/wp-plugins/abtest Tested on: Chrome Vulnerable Fil...

WordPress Beauty & Clean 1.0.8 Theme - Arbitrary File Upload

Exploit for php platform in category web applications Exploit Title: Wordpress Beauty Theme File Upload Vulnerability v1.0.8 Discovery Date: 02.09.2016 Public Disclosure Date:03.09.2016 Vendor Homepage: http://www.yourinspirationweb.com Exploit Author: Colette Chamberland Wordfence Contact:...

WordPress Theme Beauty & Clean 1.0.8 - Arbitrary File Upload

Exploit Title: Wordpress Beauty Theme File Upload Vulnerability v1.0.8 Discovery Date: 02.09.2016 Public Disclosure Date:03.09.2016 Vendor Homepage: http://www.yourinspirationweb.com Exploit Author: Colette Chamberland Wordfence Contact: [email protected] Version: 1.0.8 may affect newer...

汇能网站群管理系统 researchinfo_dan.jsp 参数researchId SQL注入漏洞

0x01漏洞简介 汇能网站群管理系统广泛应用于政府部门和国企，用户量较大。其在/main/model/childcatalog/researchinfodan.jsp由于对参数researchId过滤不严格，导致出现SQL注入漏洞。远程攻击者可以利用union方式，执行SQL指令，获取敏感信息。 0x02 Google Dork 0x03漏洞证明 SQL注入漏洞文件位置： /main/model/childcatalog/researchinfodan.jsp?researchId=1...

SOLIDserver <= 5.0.4 - Local File Inclusion

Exploit for php platform in category web applications Title: SOLIDserver =5.0.4 - Local File Inclusion Vunerability Author: Saeed reza Zamanian penetrationtest @ Linkedin Product: SOLIDserver Tested Version: : 5.0.4 and 4.0.2 Vendor: efficient IP http://www.efficientip.com Google Dork: SOLIDserve...

Dimofinf CMS 3.0.0 Cross Site Scripting

Exploit Title : Dimofinf CMS 3.0.0 Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.dimofinf.net/index.php Google Dork : "Powered by Dimofinf cms Version 3.0.0" Date: 2016/02/17 Version = 3.0.0 PoC: Username: MobhaM" onmouseover=alert"MobhaM" bad=" Password : 0...

Network Scanner 4.0.0.0 SEH Crash Proof Of Concept

-- coding: utf-8 -- Exploit Title: Network Scanner Version 4.0.0.0 SEH Crash POC POC Dork: N/A Date: 2016-02-15 Author: INSECT.B Twitter : @INSECT.B Facebook : https://www.facebook.com/B.INSECT00 Blog : http://binsect00.tistory.com Vendor Homepage: http://www.mitec.cz/ Software Link:...

A.Shop 3.9.3 Cross Site Scripting

Exploit Title : A.Shop 3.9.3 Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.ashopsoftware.com/tour-dx/shopping-cart-catalog.htm Google Dork : inurl:"/ashop/catalogue.php?cat= " Date: 2016/02/12 Version = 3.9.3 PoC: msg=XSS Payload = alert1;...

SMEweb 1.5f Cross Site Scripting / SQL Injection

Exploit Title : SMEweb 1.5f Multiple Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://www.ebizzi.net/ Google Dork : "Powered by SMEweb" Date: 2016/02/07 Version: 1.5f PoC: 1-Admin Page Bypass Username : '=''or' Password : '=''or' Demo :...

Wordpress Feed Statistics Plugin V 1.4.3 feed-statistics.php 重定向漏洞

0x01 漏洞简述 URL 重定向也就是 URL跳转，攻击者可以构造URL将用户的访问重定向到指定页面。 Wordpress Feed Statistics Plugin V 1.4.3 feed-statistics.php 文件中存在重定向漏洞，攻击者通过构造url的base64编码，可以将用户的访问重定向到指定页面。 公开时间：2016-01-09 Google Dork : "inurl:wp-content/plugins/wordpress-feed-statistics/feed-statistics.php?url=" 0x02 漏洞细节 漏洞页面：...

V3n0M-Scanner - Popular SQLi and Pentesting Scanner

V3n0M runs on Python3 Live Project - Readding old features back in and improved for Python3 v3n0m is a free and open source scanner. Evolved from baltazar's scanner, it has adapted several new features that improve fuctionality and usability. It is mostly experimental software. This program is fo...

Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title: HttpFileServer 2.3.x Remote Command Execution Google Dork: intext:"httpfileserver 2.3" Date: 04-01-2016 Remote: Yes Exploit Author: Avinash Kumar Thapa aka "-Acid" Vendor Homepage: http://rejetto.com/ Softwar...

ATOMYMAXSITE 2.5 Cross Site Scripting

Exploit Title : ATOMYMAXSITE CMS Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://maxtom.sytes.net/ Google Dork : "Power by : ATOMYMAXSITE 2.5" OR Powered by ATOMYMAXSITE 2.5 Date: 2015/12/23 Version = 2.5 Payload : "PersianHack Team Demo:...

ATOMYMAXSITE 2.5 SQL Injection

Exploit Title : ATOMYMAXSITE 2.5 SQL Injection Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://www.ibizz.nl/ Google Dork : "Power by : ATOMYMAXSITE 2.5" OR Powered by ATOMYMAXSITE 2.5 Date: 2015/12/24 Version : 2.5 Demo:...