Smart Chat 1.0.0 - SQL Injection

Smart Chat 1.0.0 - SQL Injection Exploit Title: Smart Chat - PHP Script 1.0.0 - Authentication Bypass Dork: N/A Date: 28.08.2017 Vendor Homepage: http://codesgit.com/ Software Link: https://www.codester.com/items/997/smart-chat-php-script Demo: http://demos.codesgit.com/smartchat/ Version: 1.0.0...

Apache2Triad Cross-Site Request Forgery Vulnerability

Apache2Triad is a server software deployment solution for Windows-based platforms. A cross-site request forgery vulnerability exists in Apache2Triad version 1.5.4. A remote attacker can exploit this vulnerability by sending a request to the phpsftpd/users.php file to add or remove user accounts...

CVE-2017-11154: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...

Western Digital MyCloud multi_uploadify File Upload Vulnerability

This module exploits a file upload vulnerability found in Western Digital's MyCloud NAS web administration HTTP service. The /web/jquery/uploader/multiuploadify.php PHP script provides multipart upload functionality that is accessible without authentication and can be used to place a file anywher...

REDDOXX Appliance Cross Site Scripting

Advisory: Cross-Site Scripting in REDDOXX Appliance RedTeam Pentesting discovered a cross-site scripting XSS vulnerability in the REDDOXX appliance software, which allows attackers to inject arbitrary JavaScript code via a crafted URL. Details ======= Product: REDDOXX Appliance Affected Versions:...

CVE-2017-11347

Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php...

Remote code execution

Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php...

MetInfo 5.3.17 Authenticated Code Execution Vulnerability(CVE-2017-11347)

MetInfo 5.3.17 Authenticated Code Execution Vulnerability Technical Description: We can use the GPC data to register variables in admin/include/common.inc.php: php foreacharray'COOKIE', 'POST', 'GET' as $request foreach$$request as $key = $value $key0 != '' && $$key = daddslashes$value,0,0,1;...

CVE-2017-11347: Undefined Security Weakness

Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php...

CVE-2017-11347

Authenticated Code Execution Vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script with the content of a malicious image, related to admin/include/common.inc.php and admin/app/physical/physical.php...

Cross-site Scripting (XSS)

teampass is vulnerable to cross-site scripting XSS. The library does not sanitize input string for the role and labels fields. This allows a malicious user to inject and execute arbitrary php script...

Coppermine Gallery 1.5.44 Directory Traversal

Coppermine Gallery = 1.5.44 directory traversal vulnerability ============================================================== Coppermine is a multi-purpose fully-featured and integrated web picture gallery script written in PHP using GD or ImageMagick as image library with a MySQL backend. A...

Membership Formula - order SQL Injection

Membership Formula - order SQL Injection Exploit Title: Membership Formula - Best Membership Site PHP Script - SQL Injection Google Dork: N/A Date: 31.03.2017 Vendor Homepage: http://www.zeescripts.com/ Software:...

Membership Formula SQL Injection

Exploit Title: Membership Formula - Best Membership Site PHP Script - SQL Injection Google Dork: N/A Date: 31.03.2017 Vendor Homepage: http://www.zeescripts.com/ Software: http://www.zeescripts.com/store/membership-formula-v1.0-best-membership-site-php-script.html Demo:...

Membership Formula - order Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Membership Formula - Best Membership Site PHP Script - SQL Injection Google Dork: N/A Date: 31.03.2017 Vendor Homepage: http://www.zeescripts.com/ Software:...

Membership Formula - 'order' SQL Injection

Exploit Title: Membership Formula - Best Membership Site PHP Script - SQL Injection Google Dork: N/A Date: 31.03.2017 Vendor Homepage: http://www.zeescripts.com/ Software: http://www.zeescripts.com/store/membership-formula-v1.0-best-membership-site-php-script.html Demo:...

Job Portal Script 3.0 Cross Site Scripting / SQL Injection Vulnerabilities

Exploit for php platform in category web applications Title: Job portal Script v3.0 - SQL Injection / Cross Site Scripting Credit: Bilal KARDADOU Vendor: www.jobportalscript.com Vendor URL: http://www.jobportalscript.com/index.html Product: Job portal site. Google Dork: categorysearch.php?indus=...

MLM Binary Plan Script 2.0.5 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: MLM Binary Plan Script v2.0.5 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/mlm-binary-plan-script/ Demo:...

Entrepreneur B2B Script 2.0.4 - id SQL Injection

Entrepreneur B2B Script 2.0.4 - id SQL Injection Exploit Title: Entrepreneur B2B Script v2.0.4 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software : http://www.phpscriptsmall.com/product/entrepreneur-b2b-script/ Demo:...

Multireligion Responsive Matrimonial Script 4.7.1 - SQL Injection

Multireligion Responsive Matrimonial Script 4.7.1 - SQL Injection Exploit Title: Multireligion Responsive Matrimonial Script v4.7.1 - SQL Injection Google Dork: N/A Date: 06.03.2017 Vendor Homepage: http://www.phpscriptsmall.com/ Software :...