hlstats-xss.txt

HLstats v1.35 Cross-Site Scripting Vulnerability HLstats contains a cross-site scripting vulnerability that may be exploited through the URI. Vulnerability: http://target.com/hlstats/hlstats.php/"alert1 Vulnerable: HLstats v1.35 other versions may also be vulnerable Google d0rk: "generated in...

vpasp-xss.txt

VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability discovered by John Martinelli of RedLevel Security Google d0rk: intitle:"VP-ASP Shopping Cart 6.50" file shopcontent.asp - variable type - method get "...

RedLevel Advisory #017 - HLstats v1.35 Cross-Site Scripting Vulnerability #2

!-- HLstats v1.35 - Cross-Site Scripting Vulnerability 2 Vulnerable Variable: action Vulnerable File: hlstats.php Vulnerable: HLstats 1.2 other versions may also be vulnerable Google d0rk: "generated in real-time by HLstats" John Martinelli [email protected] RedLevel Security...

RedLevel Advisory #015 - Redoable 1.2 Cross-Site Scripting Vulnerability (patch included)

note to editors: this patch resolves this vulnerability: http://redlevel.org/wp-content/uploads/patch.zip !-- Redoable 1.2 - Cross-Site Scripting Vulnerability --------------- Vulnerable Code --------------- header.php line 6: ... elseif issearch ? Search for ?php echo $s ... searchloop.php line...

WordPress Theme Redoable 1.2 - 'header.php?s' Cross-Site Scripting

source: https://www.securityfocus.com/bid/24037/info Redoable is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...

podium-cookie.txt

Podium CMS - Cookie Manipulation Exploit Podium CMS - Cookie Manipulation Exploitdiscovered by John MartinelliGoogle d0rk: inurl:"podium/Default.aspx" "...

Bradford CampusManager v3.1(6) Sensitive Data Disclosure

Bradford CampusManager v3.16 Sensitive Data Disclosure The following directories should be protected from world readability. Child folders include backup, log, and configuration files. http://cmnms.target.com:8080/runTime/ http://cmnms.target.com:8080/remediationReports/ Vulnerable: CampusManager...

CVE-2007-2370

SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a jobsview action. NOTE: the module name was originally reported as Job Listings...

CVE-2007-2370

SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a jobsview action. NOTE: the module name was originally reported as Job Listings...

CVE-2007-2370

CVE-2007-2370 : Concrete details across connected documents show a SQL injection in the XOOPS Jobs module (John Mordo Jobs) for XOOPS, affecting version 2.4 and earlier. The vulnerability resides in index.php (modules/jobs/index.php) where user input in the cid parameter of a jobsview action is n...

CVE-2007-2370: Undefined Security Weakness

SQL injection vulnerability in index.php in the John Mordo Jobs 2.4 and earlier module for XOOPS allows remote attackers to execute arbitrary SQL commands via the cid parameter in a jobsview action. NOTE: the module name was originally reported as Job Listings...

phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit

No description provided by source. !-- phpMySpace Gold v8.10 - Blind SQL/XPath Injection Exploit Vulnerable Variable: itemid Vulnerable File: modules/news/article.php Vulnerable: phpMySpace Gold v8.10 other versions should also be vulnerable Google d0rk: "Powered by phpMySpace Gold 8.10" John...

Ripe Website Manager (<= 0.8.4) - SQL Injection Vulnerability and Cross-Site Scripting Exploit

!-- Ripe Website Manager = 0.8.4 - SQL Injection Vulnerability and Cross-Site Scripting Exploit Vulnerable Variable: ripeformpost Cross-Site Scripting and SQL Injection possible Vulnerable File: contact/index.php Vulnerable: Ripe Website Manager = 0.8.4 Google d0rk: "Powered by Ripe Website...

phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit

!-- phpMySpace Gold v8.10 - Blind SQL/XPath Injection Exploit Vulnerable Variable: itemid Vulnerable File: modules/news/article.php Vulnerable: phpMySpace Gold v8.10 other versions should also be vulnerable Google d0rk: "Powered by phpMySpace Gold 8.10" John Martinelli [email protected]...

pmsgold-sql.txt

phpMySpace Gold v8.10 - Blind SQL/XPath Injection Exploit phpMySpace Gold v8.10 - Blind SQL/XPath Injection Exploitdiscovered by John MartinelliGoogle d0rk: "Powered by Ripe Website Manager"...

Ripe Website Manager 0.8.4 - '/contact/index.php?ripeformpost' SQL Injection

source: https://www.securityfocus.com/bid/23597/info Ripe Website Manager Ripe Website Manager discovered by John MartinelliGoogle d0rk: "Powered by Ripe Website Manager" alert1;"...

NuclearBB Alpha 1 - Multiple Blind SQL/XPath Injection Vulnerabilities

NuclearBB Alpha 1 - Multiple Blind SQL/XPath Injection Vulnerabilities Vulnerable: NuclearBB Alpha 1 Google d0rk: "This forum is powered by NuclearBB" ============= String Inputs ============= ---------------------------- login.php - $POST'submit' ---------------------------- username=xyz...

galix.txt

GaliX² v2.0 - Cross-Site Scripting Exploit GaliX² v2.0 - Cross-Site Scripting Exploitdiscovered by John MartinelliGoogle d0rk: "GaliX² v2.0" alert1;"...

nuclearbb-sql.txt

NuclearBB Alpha 1 - Multiple Blind SQL/XPath Injection Vulnerabilities Vulnerable: NuclearBB Alpha 1 Google d0rk: "This forum is powered by NuclearBB" ============= String Inputs ============= ---------------------------- login.php - $POST'submit' ---------------------------- username=xyz...

CodeBreak 1.1.2 (codebreak.php) Remote File Inclusion Exploit

No description provided by source. !-- CodeBreak codebreak.php processmethod - Remote File Inclusion Vulnerability Google d0rk: intitle:"CodeBreak - Hidden Morse Code" Vulnerable Code: include$POST"processmethod" . "" . $POST"outputmethod" . ".inc"; John Martinelli [email protected]...