CMSeeK v1.0.5 - CMS Detection And Exploitation Suite

What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.0.5 19-07-2018 - Version 1.0.4...

CMSeeK - CMS Detection And Exploitation Suite

What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.0.0 15-06-2018 Functions Of CMSeek:...

User emails visible in page source

A customer reported that user emails are being included in the page source on issue pages. Even with email visibility set to "Hidden", the reporter and assignee emails are included in the page source. The email is in an attribute called data-user as part of a span tag. Example from this page:...

CVE-2017-1705

IBM Security Privileged Identity Manager 2.1.0 contains left-over, sensitive information in page comments. While this information is not visible at first it can be obtained by viewing the page source. IBM X-Force ID: 134427...

Pornhub: xss

The researcher found a GET parameter, the value of which was output in the page source, resulting in XSS...

CVE-2017-17463

Vivo modems allow remote attackers to obtain sensitive information by reading the index.cgi?page=wifi HTML source code, as demonstrated by ssid and pskwepkey fields...

Mozilla Firefox Arbitrary Code Execution Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Developer Tools is one of the development tools. An arbitrary code execution vulnerability exists in the Developer Tools feature of Mozilla Firefox prior to version 55, where the program fails to properl...

U.S. Dept Of Defense: reflected xss @ www.█████████

Summary: https://www.██████████/█████████is vulnerable to cross site scripting attacks. PoC Sending the following POST request to /█████ triggers the xss:...

IBC Solar ServeMaster Plain Text Password Vulnerability

ServeMaster TLP+ and Danfoss TLX Pro+ are web-based SCADA systems. A plain text password vulnerability exists in ServeMaster TLP+ and Danfoss TLX Pro+. An attacker can exploit this vulnerability to obtain a plain text password by viewing the web page source code...

iBall 150M Wireless-N ADSL2+ Router Authentication Bypass Vulnerability

The CGI script used in the iBall 150M Wireless-N ADSL2+ router does not validate credentials. Hence any page in the router can be directly accessed by replacing page extension with .cgi. Exploit Title: iBall 150M Wireless-N ADSL2+ Router Authentication Bypass and Vulnerability Date: 23\04\2015...

Page Source Code Leakage Vulnerability of Time Collaboration Government Affairs Open Portal System

Xi'an Synergy Time Software Co., Ltd SYNSOFT, located in Xi'an Hi-Tech Industrial Development Zone, is a leading middleware product supplier in China, and the most complete integrated middleware series product provider in China. Some pages of Synergy Time government system do not have complete...

jenkins: clear text password disclosure (SECURITY-93)

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value...

FaScript FaPersianHack 1.0 - (show.php) SQL Injection Vulnerability

No description provided by source. FaScript FaPersianHack v1 Remote Sql Injection BY IRCRASH AUTHOR : IRCRASH Dr.Crash Script Download : http://fascript.com/fapersianhack.zip Injection Adress : http://Sitename/ph/show.php?id=SqL Code Help : In This Script Admin Username and Password Save in...

Acteaveidia Portals Read web.config Vulnerability

Exploit for php platform in category web applications ================================================= Acteaveidia Portals Read web.config Vulnerability ================================================= Exploit Title : Acteaveidia Portals Read web.config Vulnerability Author : ashiyane digital...

nginx information leak

It's possible to access page source code by adding 20 to URI...

CVE-2009-3544

CVE-2009-3544 affects Xerver HTTP Server 4.32. A remote attacker can disclose the source of a web page by sending a crafted HTTP request with ::$DATA appended after the filename, leading to information disclosure. Multiple sources (NVD/OpenVAS/Seebug) confirm the vulnerability and its impact as s...

Cross site scripting

The CQWeb login page in IBM Rational ClearQuest 7.0.1 allows remote attackers to obtain potentially sensitive information page source code via a combination of ?script? and ?/script? sequences in the id field, possibly related to a cross-site scripting XSS vulnerability...

FaScript FaPhoto v1 (show.php id) SQL Injection Vulnerability

No description provided by source. AUTHOR : IRCRASH Dr.Crash...

FaScript FaPhoto v1 (show.php id) SQL Injection Vulnerability

Exploit for unknown platform in category web applications ============================================================= FaScript FaPhoto v1 show.php id SQL Injection Vulnerability ============================================================= AUTHOR : IRCRASH Dr.Crash Script Download :...

faname-sql.txt

FaScript FaName v1 Remote Sql Injection BY IRCRASH AUTHOR : IRCRASH Dr.Crash Script Download : http://www.hotscripts.com/Detailed/66472.html Injection Adress : http://Sitename/faname/page.php?id= Help : In This Script Admin Username and Password Save in ./admin/pconfig.php You can open this file...