WordPress Plugin CP Reservation Calendar 1.1.6 - SQL Injection

WordPress Plugin CP Reservation Calendar 1.1.6 - SQL Injection Exploit Title: WordPress: cp-reservation-calendar 1.1.6 SQLi injection Date: 2015-09-15 Google Dork: Index of /wp-content/plugins/cp-reservation-calendar/ Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Software Link:...

phpMoAdmin saveObject Remote Command Execution

The remote web server is hosting a version of phpMoAdmin that is affected by a remote code execution vulnerability due to improper sanitization of input passed via the 'object' POST parameter in the saveObject function in the moadmin.php script. A remote attacker can exploit this, via a specially...

CVE-2015-4065

Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...

Sql injection

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php...

Cross site scripting

Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...

CVE-2015-4064

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php...

CVE-2015-4065

Summary (CVE-2015-4065) : The WordPress Landing Pages plugin (versions before 1.8.5) contains an XSS vulnerability in shared/shortcodes/inbound-shortcodes.php. An authenticated remote user can inject arbitrary script/HTML via the post parameter passed to wp-admin/post-new.php, caused by echoing u...

WordPress Landing Pages Plugin <= 1.8.4 - XSS

Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php. Solution Upgrade the plugin...

WordPress Booking Calendar Contact Form 1.0.2 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress Booking Calendar Contact Form 1.0.2Multiple vulnerabilities Date: 2015-05-01 Google Dork: Index of /wordpress/wp-content/plugins/booking-calendar-contact-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN...

Ultimate Product Catalogue <= 3.1.2 - Unauthenticated SQL Injection

Unauthenticated SQL injection in ajax call when the plugin is counting the times a product is being seen by the web visitors. The vulnerable POST parameter is "ItemID". Vulnerable code: In file Functions/ProcessAjax.php line 67: ... $ItemID = $POST'ItemID'; $Item = $wpdb-getrow"SELECT ItemViews...

WordPress Plugin MiwoFTP CSRF Arbitrary File Deletion Vulnerability

WordPress is a blogging platform developed using the PHP language, users can set up their own weblogs on servers that support PHP and MySQL databases.MiwoFTP is a smart, fast, lightweight file manager plugin. WordPress plugin MiwoFTP CSRF has a security vulnerability. Due to the input passed to t...

OrangeHRM /index.php/recruitment/viewCandidates sortField SQL Injection Vulnerability

OrangeHRM is an open source human resource management tools , features include employee data management , employee self-service system , attendance , allowances and recruitment and other functions . OrangeHRM /index.php/recruitment/viewCandidates fails to properly filter the 'sortField' POST...

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pent...

Multiple Vulnerabilities in TheCartPress WordPress plugin

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in TheCartPress WordPress plugin, which can be exploited to execute arbitrary PHP code, disclose sensitive data, and perform Cross-Site Scripting attacks against users of WordPress installations with the vulnerable plugin....

Plugin Info Card <= 2.3.6 - Authenticated XSS

Authenticated XSS via wppic-list POST parameter in the wppicwidgetrender AJAX method which is also lacking CSRF and authorisation checks, even in the fixed version...

CVE-2014-9561

Cross-site scripting XSS vulnerability in redirlastpostlist.php in SoftBB 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the post parameter...

PHPB2B某处sql注入#2

简要描述： PHPB2B某处sql注入2 详细说明： PHPB2B某处sql注入 官网下载的最新版本 绕过全局防注入。 我们先看看全局防注入怎么写的。 以下是全局防注入用到的函数 function pbattackfilter$StrFiltKey,$StrFiltValue,$ArrFiltReq ifisarray$StrFiltValue $StrFiltValue=@implode",", $StrFiltValue; if pregmatch"/".$ArrFiltReq."/is",$StrFiltValue==1 echo $StrFiltValue;...

CVE-2014-8026

Cross-site scripting XSS vulnerability in the Guest Server in Cisco Jabber allows remote attackers to inject arbitrary web script or HTML via a 1 GET or 2 POST parameter, aka Bug ID CSCus08074...

ClipBucket CMS Xss Vulnerability

Xss Vulnerability In ClipBucket CMS @@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@@ @...

SQL Injection in Е2

Advisory ID: HTB23222 Product: Е2 Vendor: Ilya Birman Vulnerable Versions: v2844 and probably prior Tested Version: v2844 Advisory Publication: July 2, 2014 without technical details Vendor Notification: July 2, 2014 Vendor Patch: July 3, 2014 Public Disclosure: July 23, 2014 Vulnerability Type:...