WordPress Task Manager Pro plugin <=1.3.1 - Multiple Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Cross-Site Scripting XSS vulnerabilities found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on...

WordPress Task Manager Pro 1.31 Cross Site Scripting

Exploit Title: WordPress Task Manager Pro 1.31 - Multiple vulnerabilities Date: 2017-07-11 Exploit Author: 8bitsec Vendor Homepage: https://www.w3bd.com/ Software Link: http://codecanyon.net/item/task-manager-pro-all-in-one-project-based-task-management-plugin-for-wordrpress/19864872 Version: 1.3...

WordPress Task Manager Pro plugin <=1.3.1 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on the changelog of the...

WordPress Task Manager Pro <= 1.3.1 - Authenticated SQL Injection

Blind SQL Injection on task-details page task parameter. PoC Logged as a follower: https://localhost/wp/wp-admin/admin.php?page=task-details=6+and+sleep1+and+1%3D1...

Task Manager Pro <= 1.3.1 - Authenticated Cross-Site Scripting (XSS)

Multiple authenticated XSS vulnerabilities found logged as a low privileged user. PoC Authenticated Stored XSS: Logged as a follower, the lowest privileged user. Write the payload in the 'Add a comment' section Authenticated Reflected XSS On task-edit, task-details, project-details pages:...

Task Manager Pro <= 1.3.1 - Authenticated Cross-Site Scripting (XSS)

Multiple authenticated XSS vulnerabilities found logged as a low privileged user. Authenticated Stored XSS: Logged as a follower, the lowest privileged user. Write the payload in the 'Add a comment' section Authenticated Reflected XSS On task-edit, task-details, project-details pages:...

ManageEngine Password Manager Pro CSRF Vulnerability (Apr 2017)

ManageEngine Password Manager Pro is prone to a cross-site request forgery CSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in ManageEngine Password Manager Pro before 8.5 Build 8500...

CVE-2016-1161

Cross-site request forgery CSRF vulnerability in ManageEngine Password Manager Pro before 8.5 Build 8500...

CVE-2016-1161

Cross-site request forgery CSRF vulnerability in ManageEngine Password Manager Pro before 8.5 Build 8500...

CVE-2016-1161

Cross-site request forgery CSRF vulnerability in ManageEngine Password Manager Pro before 8.5 Build 8500...

CVE-2016-1161

CVE-2016-1161 affects ManageEngine Password Manager Pro prior to 8.5 (Build 8500). The vulnerability is a CSRF flaw that could allow an attacker to perform unintended actions when a logged-in user visits a malicious URL. Public sources in the connected documents corroborate a CSRF vulnerability f...

Domains & Hostings Manager PRO 3.0 - entries Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Domains & Hostings Manager PRO v 3.0 - SQL Injection Google Dork: N/A Date: 12.02.2017 Vendor Homepage: http://endavi.com/ Software Buy: https://codecanyon.net/item/advanced-domains-and-hostings-pro-v3-multiuser/10368735 Demo:...

Domains Hostings Manager PRO 3.0 - entries SQL Injection

Domains Hostings Manager PRO 3.0 - entries SQL Injection Exploit Title: Domains & Hostings Manager PRO v 3.0 - SQL Injection Google Dork: N/A Date: 12.02.2017 Vendor Homepage: http://endavi.com/ Software Buy: https://codecanyon.net/item/advanced-domains-and-hostings-pro-v3-multiuser/10368735 Demo...

ManageEngine Password Manager Pro fails to restrict access permissions

Overview ManageEngine Password Manager Pro provided by Zoho Corporation fails to restrict access permissions. Impact A user may gain unauthorized access to other users' password entry history. Solution Update the Software This vulnerability has been addressed in Password Manager Pro 8.4.0 Build...

ManageEngine Password Manager Pro vulnerable to cross-site request forgery

Overview ManageEngine Password Manager Pro contains a cross-site request forgery vulnerability. ManageEngine Password Manager Pro provided by Zoho Corporation contains a cross-site request forgery vulnerability CWE-352. CWE-352: Cross-Site Request Forgery CSRF...

Password Manager Pro — Easiest Way to Keep Enterprises Secure

Recent corporate breaches have taught us something important — the average enterprise user is spectacularly bad at choosing good passwords. As modern enterprise is becoming a hybrid organization with infrastructure spread across on-premises data centers as well as in the cloud, security of...

Multiple Vulnerabilities in ZOHO ManageEngine Password Manager Pro

ZOHO ManageEngine Password Manager Pro PMP is a set of U.S. ZOHO ZOHO password management software. ZOHO ManageEngine PMP suffers from HTML injection, user enumeration, cross-site request forgery, power lifting, security bypass, and authentication bypass vulnerabilities. An attacker can exploit...

ZOHO ManageEngine Password Manager Pro Security Bypass Vulnerability

ZOHO ManageEngine Password Manager Pro PMP is a set of password management software from ZOHO. The software can record general password information, website login passwords, software registration codes and Email account passwords. A security bypass vulnerability exists in ZOHO ManageEngine PMP. A...

ZOHO ManageEngine Password Manager Cross-Site Request Forgery Vulnerability

ZOHO ManageEngine Password Manager Pro PMP is a set of password management software from ZOHO. The software can record general password information, website login passwords, software registration codes and Email account passwords. A cross-site request forgery vulnerability exists in versions prio...