WordPress SS Downloads Plugin <= 1.4 - XSS

Because of this vulnerability in templates/download.php, attackers can inject arbitrary web script or HTML via the "title" parameter. Solution Update the plugin...

WordPress SCv1 Local File Disclosure

Title : Wordpress SCv1 Theme Local File Disclosure + Discovered By : Medrik + CMS Home-Page : http://wordpress.org + Found Date : 2014-06-10 + Tested On : Windows This is LFD Vulnerability In : File : download.php Parameter : file Vulnerability Locate :...

NS_ASG 6.3 /commonplugin-Download.php 任意文件下载漏洞

No description provided by source...

WordPress Theme LineNity 1.20 - Local File Inclusion

WordPress Theme LineNity 1.20 - Local File Inclusion + Local File Inclusion in WordPress Theme LineNity + Date: 13/04/2014 + Risk: High + Author: Felipe Andrian Peixoto + Vendor Homepage: http://themeforest.net/item/linenity-clean-responsive-wordpress-magazine/4417803 + Contact:...

CVE-2013-6720: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in download.php in the Passive Capture Application PCA web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to bypass intended access restrictions via a .. dot dot in the log parameter, as...

PT-2014-3173

Name of the Vulnerable Software and Affected Versions IBM Tealeaf CX versions 7.x, 8.x through 8.6, 8.7 through 8.7 before FP2, 8.8 through 8.8 before FP2 Description The issue allows remote authenticated users to bypass intended access restrictions via a .. dot dot in the log parameter of the...

Sql injection

SQL injection vulnerability in download.php in Horizon Quick Content Management System QCMS 4.0 and earlier allows remote to execute arbitrary SQL commands via the category parameter...

CVE-2013-7139

SQL injection vulnerability in download.php in Horizon Quick Content Management System QCMS 4.0 and earlier allows remote to execute arbitrary SQL commands via the category parameter...

PT-2014-3270

Name of the Vulnerable Software and Affected Versions Horizon Quick Content Management System QCMS versions 4.0 and earlier Description The issue allows remote execution of arbitrary SQL commands via the category parameter in the "download.php" file. Recommendations For QCMS versions 4.0 and...

CVE-2013-7139: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in download.php in Horizon Quick Content Management System QCMS 4.0 and earlier allows remote to execute arbitrary SQL commands via the category parameter...

NITC 3.21 /download.php 任意文件下载漏洞

No description provided by source...

Dedecms v57 sp1 plus/download.php SQL注入漏洞

起因是全局变量$GLOBALS可以被任意修改，随便看了下，漏洞一堆，我只找了一处。 codeinclude/dedesql.class.php ifisset$GLOBALS'arrs1' $v1 = $v2 = ''; for$i=0;isset$arrs1$i;$i++ $v1 .= chr$arrs1$i; for$i=0;isset$arrs2$i;$i++ $v2 .= chr$arrs2$i; //解码ascii $GLOBALS$v1 .= $v2; //注意这里不是覆盖，是+ function SetQuery$sql $prefix="@"; $sql =...

CVE-2012-6434: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...

PT-2013-1943

Name of the Vulnerable Software and Affected Versions e107 version 1.0.2 Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks. This is achieved through multiple cross-site request forgery CSRF vulnerabilities ...

Manhali 1.8 - Local File Inclusion

Exploit Title: Manhali v1.8 Local File Inclusion Vulnerability Date: 20/09/2012 Author: L0n3ly-H34rT Contact: [email protected] My Site: http://se3c.blogspot.com/ Vendor Link: http://www.manhali.com/ Software Link: http://sourceforge.net/projects/manhali/files/manhali1.8.zip/download Versio...

PT-2012-4588

Name of the Vulnerable Software and Affected Versions Kayako Fusion versions 4.40.1148 through 4.50.1581 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the PATH INFO in the...

CVE-2012-3233: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in swift/thirdparty/PHPExcel/PHPExcel/Shared/JAMA/docs/download.php in Kayako Fusion 4.40.1148, and possibly before 4.50.1581, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

SaltOS - download.php Cross-Site Scripting

SaltOS - download.php Cross-Site Scripting source: https://www.securityfocus.com/bid/55117/info SaltOS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of...

Rama Zeiten CMS Remote File Disclosure Vulnerability

Exploit for php platform in category web applications 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS, etc. 1 1 1 0 +...

CVE-2012-2398

Cross-site scripting XSS vulnerability in files/ajax/download.php in ownCloud before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via the files parameter, a different vulnerability than CVE-2012-2269.4...