2595 matches found
ResourceSpace 7.1.6513 Local File Inclusion Vulnerability
ResourceSpace version 7.1.6513 suffers from a local file inclusion vulnerability. Product: ResourceSpace Vendor: Montala Limited Vulnerable Versions: 7.1.6513 and probably prior Tested Version: 7.1.6513 Advisory Publication: May 6, 2015 without technical details Vendor Notification: May 6, 2015...
ResourceSpace 7.1.6513 Local File Inclusion
Advisory ID: HTB23258 Product: ResourceSpace Vendor: Montala Limited Vulnerable Versions: 7.1.6513 and probably prior Tested Version: 7.1.6513 Advisory Publication: May 6, 2015 without technical details Vendor Notification: May 6, 2015 Vendor Patch: June 1, 2015 Public Disclosure: June 3, 2015...
Multiple Vulnerabilities in TheCartPress WordPress plugin
Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...
WordPress TheCartPress 1.3.9 XSS / Local File Inclusion
Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor...
WordPress TheCartPress Plugin 1.3.9 - Multiple Vulnerabilities
Exploit for php platform in category web applications Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public...
WordPress TheCartPress Plugin 1.3.9 - Multiple Vulnerabilities
TheCartPress plugin is prone to multiple vulnerabilities, such as local PHP file inclusion, stored XSS, improper access control and multiple XSS vulnerabilities. Solution Update the plugin...
WordPress Plugin TheCartPress 1.3.9 - Multiple Vulnerabilities
Advisory ID: HTB23254 Product: TheCartPress WordPress plugin Vendor: TheCartPress team Vulnerable Versions: 1.3.9 and probably prior Tested Version: 1.3.9 Advisory Publication: April 8, 2015 without technical details Vendor Notification: April 8, 2015 Public Disclosure: April 29, 2015 Vulnerabili...
Avsarsoft Matbaa Script Cross Site Scripting / Shell Upload
Title : Avsarsoft Matbaa Script - Multiple Vulnerabilities Author : ZoRLu / [email protected] Website : milw00rm.com / milw00rm.net / milw00rm.org Twitter : https://twitter.com/milw00rm or @milw00rm Test : Windows7 Ultimate Discovery : 15/04/15 Publish : 23/04/15 Thks : exploit-db.com,...
大米CMS最新版一个参数引发多处sql注入， 绕过防御(附验证脚本)
简要描述： 过滤不严 详细说明： 出现注入的地方是在ApiAction.class.php文件ajaxarclist函数 function ajaxarclist $prefix = !empty$REQUEST'prefix'?bool$REQUEST'prefix':true; //表过滤防止泄露信息,只允许的表 if!inarray$REQUEST'model',array'article','type','ad','label','link'exit; if!empty$REQUEST'model' if$prefix == true $model =...
Berta CMS File Upload Bypass Vulnerability
Exploit for php platform in category web applications Berta CMS is a web based content management system using PHP and local file storage. http://www.berta.me/ Due to use of a 3rd party Berta CMS website to redirect links within a phishing email brought to our attention we checked the file upload...
X2Engine < 3.5.1 Multiple Vulnerabilities
According to its version number, the X2Engine application installed on the remote web server is prior to version 3.5.1. It is, therefore, potentially affected by multiple vulnerabilities : - A PHP file inclusion vulnerability exists due to insufficient sanitization of the 'file' HTTP GET paramete...
EUVD-2015-1559
Multiple cross-site scripting XSS vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 horder, 2 jakcatid, 3 jakcontent, 4 jakcss, 5 jakdeletelog, 6 jakemail, 7 jakextfile, 8 jakfile, 9 jakhookshow, 10 jakimg, 11 jakjavascript, 12...
vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion SQL Injection Cross-Site Scripting
vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion SQL Injection Cross-Site Scripting Exploit Title: vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion, SQL Injection & XSS Date: January 8, 2015 Exploit Author: Technidev https://technidev.com Vendor Homepage: https://vbulletin.com Software...
方维购物分享最新版前台代码漏洞
简要描述： 一步两步似魔鬼的步伐 详细说明： 缺陷文件： /core/function/global.func.php 如下： / 显示页面 @param string $cachefile 缓存路径 @param bool $issession 是否更新session @param bool $isreturn 是否返回页面内容 @return mixed / function display$cachefile = '',$issession = true,$isreturn = false global $FANWE; $content = NULL;...
E-Journal 1.0 Shell Upload / SQL Injection
========================================================================================== E-Journal Old Version Multiple Vulnerabilities ==========================================================================================...
ECStore开源网店系统任意文件修改漏洞可拿shell
简要描述： 模板编辑中的文件编辑功能，对可编辑的文件限制不严，导致可以修改系统中存在的任意文件 详细说明： 文件编辑功能中选择要修改的文件，这里选图片（模板文件也可以），然后上传图片时将filename参数设置为网站的任意php文件，如/index.php或/config/config.php，将图片内容设置为shell内容。。。。 post数据如下： POST /index.php/shopadmin/index.php?app=site&ctl=adminexplorertheme&act=saveimage HTTP/1.1 Host: shop.xxx.com...
CVE-2014-8770
Unrestricted file upload vulnerability in magmi/web/magmi.php in the MAGMI aka Magento Mass Importer plugin 0.7.17a and earlier for Magento Community Edition CE allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP fil...
Multiple vulnerabilities in EspoCRM
Advisory ID: HTB23238 Product: EspoCRM Vendor: http://www.espocrm.com Vulnerable Versions: 2.5.2 and probably prior Tested Version: 2.5.2 Advisory Publication: October 8, 2014 without technical details Vendor Notification: October 8, 2014 Vendor Patch: October 10, 2014 Public Disclosure: October...
EspoCRM 2.5.2 XSS / LFI / Access Control Vulnerabilities
EspoCRM version 2.5.2 suffers from cross site scripting, local file inclusion, and improper access control vulnerabilities. Product: EspoCRM Vendor: http://www.espocrm.com Vulnerable Versions: 2.5.2 and probably prior Tested Version: 2.5.2 Advisory Publication: October 8, 2014 without technical...