Wordpress Reflex Gallery Upload Vulnerability

This module exploits an arbitrary PHP code upload in the WordPress Reflex Gallery version 3.1.3. The vulnerability allows for arbitrary file upload and remote code execution. Module Options msf use exploit/unix/webapp/wp/reflexgalleryfileupload msf undefinedreflexgalleryfileupload show actions...

CVE-2012-3873

Multiple SQL injection vulnerabilities in Open Constructor 3.12.0 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to 1 data/gallery/edit.php, 2 data/guestbook/edit.php, 3 data/file/edit.php, 4 data/htmltext/edit.php, 5 data/publication/edit.php, or 6...

Sql injection

Multiple SQL injection vulnerabilities in Open Constructor 3.12.0 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to 1 data/gallery/edit.php, 2 data/guestbook/edit.php, 3 data/file/edit.php, 4 data/htmltext/edit.php, 5 data/publication/edit.php, or 6...

CVE-2012-4477

Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors...

CVE-2012-4478

Cross-site request forgery CSRF vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators...

Cross site scripting

Cross-site scripting XSS vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators...

Sql injection

SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-4477

Affected software: Drupal Drag & Drop Gallery module (6.x). Vulnerability type: Access bypass in the module’s handling of uploads and access controls (CVE-2012-4477). Root cause: unresolved access-control flaws in the Drag & Drop Gallery code path that can allow remote attackers to bypass restric...

CVE-2012-4478

The CVE-2012-4478 vulnerability is a CSRF flaw in Drupal’s Drag & Drop Gallery 6.x module that can enable remote attackers to hijack an administrator’s session. Affected component: Drag & Drop Gallery module (Drupal contrib) 6.x. Root cause: CSRF in the module’s handling of admin actions, allowin...

CVE-2012-4478

Cross-site request forgery CSRF vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators...

CVE-2012-4476

CVE-2012-4476 is an XSS vulnerability in the Drupal Drag & Drop Gallery module 6.x. The issue arises in the module’s file handling/uploads logic, with vectors not publicly specified in the provided docs. An advisory notes exploitation exists and that there is no patch; mitigation is to disable an...

WordPress - PICA Photo Gallery Automatic SQL Injection (perl)

Exploit for php platform in category web applications Exploit title: WordPress - PICA Photo Gallery Automatic SQL Injection perl Author: D35m0nd142 Software Link: http://www.apptha.com/category/extension/Wordpress/PICA-Photo-Gallery Google Dork: intext:"Powered by Apptha." inurl:gallery Thanks to...

WordPress Kakao Theme SQL Injection

Exploit Title : Wordpress theme kakao Sql Injection Author : Iranian DataCoders Security Team Discovered By : sil3nt Home : www.datacoders.org/ Security Risk : High - SQL Injection Dork : inurl:themes/wilderness/gallery.php Expl0iTs : Target/wp-content/themes/kakao/sonHaberler.php?ID=sql D3m0 :...

WordPress All Video Gallery Plugin 1.1 - SQL Injection Vulnerability

This WordPress All Video Gallery plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

CVE-2012-4485

Multiple cross-site scripting XSS vulnerabilities in the galleryformatterfieldformatterview functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject arbitrary web script or...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the galleryformatterfieldformatterview functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject arbitrary web script or...

CVE-2012-4485

Multiple cross-site scripting XSS vulnerabilities in the galleryformatterfieldformatterview functiuon in galleryformatter.tpl.php the Gallery formatter module before 7.x-1.2 for Drupal allow remote authenticated users with permissions to create a node or entity to inject arbitrary web script or...

[waraxe-2012-SA#094] - Multiple Vulnerabilities in Wordpress GRAND Flash Album Gallery Plugin

waraxe-2012-SA094 - Multiple Vulnerabilities in Wordpress GRAND Flash Album Gallery Plugin ============================================================================================= Author: Janek Vind "waraxe" Date: 24. October 2012 Location: Estonia, Tartu Web:...

WordPress GRAND Flash Album Gallery SQL Injection / Disclosure / File Overwrite

waraxe-2012-SA094 - Multiple Vulnerabilities in Wordpress GRAND Flash Album Gallery Plugin ============================================================================================= Author: Janek Vind "waraxe" Date: 24. October 2012 Location: Estonia, Tartu Web:...