Pinterest Bug Bounty #1 - Persistent CNAME Vulnerability

Document Title: =============== Pinterest Bug Bounty 1 - Persistent CNAME Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1431 Release Date: ============= 2015-06-30 Vulnerability Laboratory ID VL-ID: ==================================== 14...

NewStatPress <= 1.0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

An insufficient user input validation of HTTP-Header: "Referer" results in a persistent XSS in the WordPress admin-panel. An attacker may be able to access any cookies, session tokens or other sensitive information retained by the browser and used with that site...

Ebay Magento Bug Bounty #14 - Persistent Vulnerability

Document Title: =============== Ebay Magento Bug Bounty 14 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1463 EIBBP-31602 Release Date: ============= 2015-06-30 Vulnerability Laboratory ID VL-ID:...

Novius 5.0.1 - Multiple Vulnerabilities

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-NOVIUSOS0629.txt Vendor: ======================= community.novius-os.org Product: =============================================================== novius-os.5.0.1-elche is a PHP...

GetSimple CMS 5.7.3.1 Cross Site Scripting

Date: 29/06/2015 Discovered by: Joel Vadodil Varghese Type of vulnerability: Persistent XSS Tested on: Windows 7 Product: GetSimple CMS Version: 5.7.3.1 Description: Application is vulnerable to Persistent XSS attack on page - URL -...

Novius OS 5.0.1-elche XSS / LFI / Open Redirect

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-NOVIUSOS0629.txt Vendor: ======================= community.novius-os.org Product: =============================================================== novius-os.5.0.1-elche is a PHP...

Pinterest Bug Bounty #1 - Persistent CNAME Vulnerability

Document Title: =============== Pinterest Bug Bounty 1 - Persistent CNAME Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1431 Release Date: ============= 2015-06-29 Vulnerability Laboratory ID VL-ID: ==================================== 14...

Nucleus CMS 3.65 Cross Site Scripting

​ Exploit Title: Persistent Cross Site Scripting Vulnerability in nucleuscms Date: 25 July 2015 Exploit Author: sharan kumar somana Vendor Homepage: http://www.nucleuscms.org Software Link: http://sourceforge.net/projects/nucleuscms/?source=typredirect Version: 3.65 Tested on: Windows 7 nucleuscm...

WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities

WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion Date: 2015-06-23 Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" Exploit Author:...

GeniXCMS 0.0.3 - Cross-Site Scripting

GeniXCMS 0.0.3 - Cross-Site Scripting Exploit Title: Persistent XSS Google Dork: intitle: Persistent XSS Date: 2015-06-21 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: genixcms.org Software Link: genixcms.org Version: 0.0.3 Tested on: windows 7 Category:...

ManageEngine Asset Explorer 6.1 Cross Site Scripting

Title: =============== ManageEngine Asset Explorer v6.1 - XSS Vulnerability CVE-ID: ==================================== CVE-2015-2169 CVSS: ==================================== 3.5 Product & Service Introduction Taken from their homepage: ==================================== ManageEngine...

WordPress Huge IT Slider Plugin 2.7.5 - Multiple Vulnerabilities

There are multiple vulnerabilities in this plugin, such as cross-site request forgery and Persistent JS/HTML Injection. These vulnerabilities allow an attacker to make a user with access privileges to a page and inject JavaScript into the database. Solution Upgrade the plugin...

eBay Magento Persistent Script Insertion

Document Title: =============== Ebay Magento Bug Bounty 10 - Persistent Filename Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1457 eBay Inc. Bug Bounty Program ID: EIBBP-31603 Video: https://www.youtube.com/watch?v=WffsHd8pibE Release...

Ebay Inc Magento #10 - Persistent Filename Vulnerability

Document Title: =============== Ebay Inc Magento 10 - Persistent Filename Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1458 Video: https://www.youtube.com/watch?v=WffsHd8pibE Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1457 EIBBP-31603...

Ebay Inc Magento #10 - Persistent Filename Vulnerability

Document Title: =============== Ebay Inc Magento 10 - Persistent Filename Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1458 Video: https://www.youtube.com/watch?v=WffsHd8pibE Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1457 EIBBP-31603...

Ebay Magento Bug Bounty #10 - Persistent Vulnerability

Document Title: =============== Ebay Magento Bug Bounty 10 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1457 eBay Inc. Bug Bounty Program ID: EIBBP-31603 Video: https://www.youtube.com/watch?v=WffsHd8pibE Release Date:...

Ebay Magento Bug Bounty #10 - Persistent Vulnerability

Document Title: =============== Ebay Magento Bug Bounty 10 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1457 eBay Inc. Bug Bounty Program ID: EIBBP-31603 Video: https://www.youtube.com/watch?v=WffsHd8pibE Release Date:...

ZCMS SQL Injection &amp; Persistent XSS

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-ZCMS0612.txt Vendor: ============================================= http://zencherry.com/ http://sourceforge.net/projects/zencherrycms Product:...

Nakid-CMS CSRF, Persistent XSS &amp; LFI

Credits: John Page hyp3rlinx + Domains: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-NAKIDCMS0611.txt Vendor: ================================ http://kilrizzy.github.io/Nakid-CMS/ Product: ================================ kilrizzy-Nakid-CMS-f274624 Nakid CMS is...

ZCMS 1.1 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications Exploit Title: SQL Injection & Persistent XSS Google Dork: intitle: SQL Injection & Persistent XSS Date: 2015-06-12 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: zencherry.com Software Link:...