GeoCore MAX DB Ver. 7.3.3 - Blind SQL Injection

GeoCore MAX DB Ver. 7.3.3 - Blind SQL Injection Exploit Title: GeoCore MAX DB Ver. 7.3.3 - Time-Based Blind Injection Official site: http://geodesicsolutions.com Risk Level: High Vendor : http://geodesicsolutions.com Exploit Author: Esac Homepage author : www.iss4m.ma Last Checked: 25/04/2014...

PT-2014-4880

Name of the Vulnerable Software and Affected Versions VideoWhisper Webcam plugins for Drupal versions 7.x Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur...

Adem 0.5.1 - Local File Inclusion

Adem 0.5.1 - Local File Inclusion ----------exploit Debut Local File Include Vulnerability ----------Script Info Author : JIKO ----------Script Info Site : https://github.com/4FSB/Adem && http://adem.faares.com/demo Version : 0.5.1 Download : https://codeload.github.com/4FSB/Adem/zip/master...

SNEHA IT Soluctions's LFI Vulnerabilities

Exploit for windows platform in category web applications --------------------index.php-------------------- $page = $GET'page'; if$page!="" $p= $page; else echo "window.location = 'index.php';"; include SOURCES . $p; --------------------index.php-------------------- So you can include a fil by...

CVE-2014-2736: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...

PT-2014-4893

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.2.14 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the session ID PHPSESSID to index.php. Additionally, remote authenticated users can execute...

CMS Morpheus SQL Injection

SQL Injection on CMS Morpheus Risk: High CWE number: CWE-89 Date: 19/04/2014 Vendor: www.pixel-dusche.de Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Windows 8 pro Vulnerable File: index.php Exploit: http://www.site.com/index.php?cid=SQLI...

PTCeffect 4.6 - Local File Inclusion SQL Injection

PTCeffect 4.6 - Local File Inclusion SQL Injection Exploit Title: PTCeffect LFI & SQL Injection Vulnerabilities Google Dork: find it : Date: 2014-04-19 Exploit Author: Walidz Software Link: http://www.ptceffect.com/ Version: 4.6 Tested on: windows,linux,mac os CVE : N/A The LFI vulnerability is i...

PTCeffect 4.6 Local File Inclusion / SQL Injection

Exploit Title: PTCeffect LFI & SQL Injection Vulnerabilities Google Dork: find it : Date: 2014-04-19 Exploit Author: Walidz Software Link: http://www.ptceffect.com/ Version: 4.6 Tested on: windows,linux,mac os CVE : N/A The LFI vulnerability is in index.php...

Localize: Uninitialized variable error message leaks information

An uninitialized variable $alert at line 630 in index.php shows an error message. This happens after a POST /pages/createproject. The error message does not appear in the browser because the user is redirected to the new project immediately, but it is there in the HTTP response see error.png. Thi...

CMS Studio Cross Site Scripting

Multiple Cross Site Scripting on CMS STUDIO Risk: Low CWE number: CWE-79 Date: 15/04/2014 Vendor: www.cmsstudio.info Author: Felipe " Renzi " Gabriel Contact: [email protected] Tested on Windows 8 pro Vulnerable File: index.php Exploit: http://host/index.php?spageid=xss...

PT-2014-3399

Name of the Vulnerable Software and Affected Versions Gnew version 2013.1 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including gnew template to API endpoints such as "users/profile.php", "articles/index.php", ...

CVE-2014-2712

Cross-site scripting XSS vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web...

CVE-2014-2712: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in J-Web in Juniper Junos before 10.0S25, 10.4 before 10.4R10, 11.4 before 11.4R11, 12.1 before 12.1R9, 12.1X44 before 12.1X44-D30, 12.1X45 before 12.1X45-D20, 12.1X46 before 12.1X46-D10, and 12.2 before 12.2R1 allows remote attackers to inject arbitrary web...

PT-2014-1956

Name of the Vulnerable Software and Affected Versions Junos versions prior to 10.0S25 Junos versions 10.4 prior to 10.4R10 Junos versions 11.4 prior to 11.4R11 Junos versions 12.1 prior to 12.1R9 Junos versions 12.1X44 prior to 12.1X44-D30 Junos versions 12.1X45 prior to 12.1X45-D20 Junos version...

Easily around the various WAF POST injection, cross-site Defense(such as security Dog)-vulnerability warning-the black bar safety net

XXX before there was mention of a multipart request to bypass the various WAF way: 3 6 0 website po/security po/accelerating music and other similar product protection to bypass the defective one, and seemingly didn't cause much concern. Found out today that a security Dog gets smart before that ...

WebLife CMS SQL Injection

Mulitple SQL Injection on WebLife CMS Risk: High CWE number: CWE-89 Date: 09/04/2014 Vendor: www.weblife.sk Author: Felipe "Renzi" Gabriel Contact: [email protected] Tested on Windows 8 pro Vulnerable File: index.php Exploit: http://host/index.php?jazyk=SQLI http://host/index.php?page=SQLI PoC:...

PT-2014-2288

Name of the Vulnerable Software and Affected Versions Zingiri Forum plugin versions prior to 1.4.4 Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the zing forum output function. This is achieved by including a .. dot dot in the...

CVE-2013-0807

Cross-site scripting XSS vulnerability in the NewSectionPrompt function in include/tool/editingpage.php in gpEasy CMS 3.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the section parameter in a newsection action to index.php...