Wordpress jQuery mOover Admin Bypass Vulnerability

An attacker can change configurations of this Wordpress-Slideshow Plugin without admin-rights. 3 Proof-Examples are enclosed. This is private exploit. You can buy it at https://0day.today...

JQuery 1.4.2 Cross Site Scripting Vulnerability

JQuery version 1.4.2 suffers from a create object option in runtime client-side cross site scripting vulnerability. XSS Reflected JQuery 1.4.2 - Create object option in runtime client-side From: Mauro Risonho de Paula Assumpção Date: 02.09.2014 13:21:20 -0300 VSLA Security Advisory...

JQuery 1.4.2 Cross Site Scripting

XSS Reflected JQuery 1.4.2 - Create object option in runtime client-side From: Mauro Risonho de Paula Assumpção Date: 02.09.2014 13:21:20 -0300 VSLA Security Advisory FIRE-XSS-Reflected-Jquery 1.4.2 2014-001: XSS Reflected JQuery 1.4.2 LEVEL: MEDIUM In our tests authorized by the customer, we can...

DomainTrader Domain Parking / Auction Script 2.5.3 CSRF / XSS

Exploit Title: DomainTrader Domain Parking and Auction Script Multiple 0day Vulnerabilities Google Dork: Find yourself xD Date: 26/8/2014 Exploit Author: Haider Mahmood | @HaiderMQ Vendor Homepage: http://www.smartscriptsolutions.com/domain-trader/ Version: Tested on Latest Version 2.5.3 Add new...

Superfish 7.x-1.9 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Superfish 7.x-1.9 Cross Site Scripting Vulnerability ==================================================== Author: Ubani A Balogun Reported: June 25, 2014 Product Description: - -------------------- Superfish integrates jQuery Superfish plugin with you...

HTML5 jQuery Audio Player 2.3 - playlist/add_playlist.php Multiple Parameter Stored XSS Weakness

The HTML5 jQuery Audio Player WordPress plugin was affected by a playlist/addplaylist.php Multiple Parameter Stored XSS Weakness security vulnerability...

HTML5 jQuery Audio Player 2.3 - playlist/add_playlist.php id Parameter SQL Injection

The HTML5 jQuery Audio Player WordPress plugin was affected by a playlist/addplaylist.php id Parameter SQL Injection security vulnerability...

WP jQuery Spam 1.1 - dynamic.php id Parameter Reflected XSS

The WP jQuery Spam WordPress plugin was affected by a dynamic.php id Parameter Reflected XSS security vulnerability...

jQuery Mega Menu 1.0 - Local File Inclusion

The JQuery Mega Menu Widget WordPress plugin was affected by a Local File Inclusion security vulnerability...

Slideshow jQuery Image Gallery - Multiple Vulnerabilities

The Slideshow WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

WordPress jQuery Spam Plugin <= 1.1 - Reflected XSS

This plugin is prone to a cross site scripting vulnerability in dynamic.php id parameter. Solution Update the plugin...

WordPress HTML5 jQuery Audio Player Plugin <= 2.3 - Stored XSS

This plugin is prone to a playlist/addplaylist.php multiple parameter stored cross site scripting vulnerability. Solution Update the plugin...

WordPress HTML5 jQuery Audio Player Plugin <= 2.3 - SQL Injection

This plugin is prone to a playlist/addplaylist.php id parameter SQL injection vulnerability. Solution Update this plugin...

ZooEffect 1.08 - HTTP Referer Reflected XSS

Description The ZooEffect Plugin for Video player, Photo Gallery Slideshow jQuery and audio / music / podcast – HTML5 WordPress plugin was affected by a HTTP Referer Reflected XSS security vulnerability...

WordPress HTML5 jQuery Audio Player Plugin <= 2.3 - Stored XSS

This plugin is prone to a playlist/addplaylist.php multiple parameter stored cross site scripting vulnerability. Solution Update the plugin...

WordPress HTML5 jQuery Audio Player Plugin <= 2.3 - SQL Injection

This plugin is prone to a playlist/addplaylist.php id parameter SQL injection vulnerability. Solution Update this plugin...

WEBMIS CMS Shell Upload

Exploit Title : WEBMIS CMS Shell Upload vulnerability Author : Jagriti Sahu Vendor : http://www.ksphp.com Download Link : https://github.com/ksphp/webmis version affected : all Date : 14/07/2014 Discovered at : IndiShell Lab Love to : Surbhi, Mradula and Harry //////////////////////// /// Overvie...

Cloupia End-to-end FlexPod Management Directory Traversal

No description provided by source. Cloupia End-to-end FlexPod Management - Directory Traversal Vulnerability Advisory Information Advisory ID: KUSTODIAN-2011-011 Date published: Jan 13, 2011 Vulnerability Information Class: Directory Traversal Remotely Exploitable: Yes Locally Exploitable: Yes...

Bypass the JQuery-Real-Person captcha plugin 0day

No description provided by source. Exploit Title: Bypass the JQuery-Real-Person captcha plugin Google Dork: if relevant we will automatically add these to the GHDB Date: 28th November, 2011 Author: Alberto Garcia-Illera Software Link: http://keith-wood.name/realPerson.html Version: 1.0.1 0-day...

jQuery uploadify 2.1.0 - Remote File Upload

No description provided by source. Exploit Title: jQuery uploadify v2.1.0 Remote File Upload Date: 21/01/2010 Author: k4cp3r/Ablus Version: v2.1.0 uploadify.swf Actionscript: function setAllowedTypes:void allowedTypes = ; if param.fileDesc && param.fileExt var fileDescs:Array =...