Premium Servers List Tracker 1.0 - SQL Injection

Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website: http://k2an.com Category: Web Application Exploits...

Premium Servers List Tracker 1.0 - SQL Injection

Premium Servers List Tracker 1.0 - SQL Injection Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

Premium Servers List Tracker 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

WordPress FormCraft Form Builder 3.2.31 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: FormCraft - Premium WordPress Form Builder Heading Heading Text input field is vulnerable. The payload will execute when the form is displayed. ================== 8bitsec - https://twitter.com/8bitsec 0day.today 2018-04-04...

WordPress FormCraft 3 premium plugin <=3.2.31 - Authenticated Stored Cross-site scripting (XSS) vulnerability

Authenticated Stored Cross-site scripting XSS vulnerability found by 8bitsec in WordPress FormCraft 3 premium plugin alternative name - FormCraft Premium WordPress Form Builder. Solution 2017.07.29 - we were unable to find any information about patched version of WordPress FormCraft 3 premium...

WordPress Plugin Ads Pro < 3.4 - Cross-Site Scripting / SQL Injection

Exploit Title: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager = 5.0.12 AND time-based blind Payload: bsaprostats=1&[email protected]&bsaproid=xx AND SLEEP5 Credits & Authors: ================== 8bitsec - https://tw...

WordPress Plugin Ads Pro 3.4 - Cross-Site Scripting SQL Injection

WordPress Plugin Ads Pro 3.4 - Cross-Site Scripting SQL Injection Exploit Title: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager = 5.0.12 AND time-based blind Payload: bsaprostats=1&[email protected]&bsaproid=xx AND S...

WordPress FormCraft Form Builder 3.2.31 Cross Site Scripting

Exploit Title: FormCraft - Premium WordPress Form Builder Heading Heading Text input field is vulnerable. The payload will execute when the form is displayed. ================== 8bitsec - https://twitter.com/8bitsec...

Cyber Insurance Rates to Rise – What Should I Do?

Organizations manage risk in three ways: they accept it, they take out insurance against it, or they take active measures to diminish its potential impact. These active measures commonly include deploying or enhancing or removing technology, updating policies and procedures, instituting training...

WordPress Task Manager Pro plugin <=1.3.1 - Multiple Authenticated Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Cross-Site Scripting XSS vulnerabilities found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on...

WordPress Task Manager Pro plugin <=1.3.1 - Authenticated SQL Injection vulnerability

Authenticated SQL Injection vulnerability found in WordPress Task Manager Pro premium plugin version 1.3.1 and earlier versions by 8bitsec. Solution 2017.07.29 - We were unable to find information about patched release of WordPress Task Manager Pro plugin. The last record on the changelog of the...

Airbnb: Call back number not verified

The issue is with the "Confirm via call functionality" While adding mobile number,the application does not verify the number that is being called back. A malicious user can change the number to any premium rate numbers which charge particular amount from the caller. It was further noticed that...

Google Removes Two Ztorg Trojans from Play Marketplace

Google, for the second time this month, has removed malicious apps from Google Play that could have laid the groundwork for an attacker to root infected devices. A researcher with Kaspersky Lab on Tuesday described how attackers managed to evade settings set in place by Google Play’s VerifyApps...

Ztorg: from rooting to SMS

I've been monitoring Google Play Store for new Ztorg Trojans since September 2016, and have so far found several dozen new malicious apps. All of them were rooting malware that used exploits to gain root rights on the infected device. Then, in the second half of May 2017 I found one that wasn't...

Wordpress NewsGamer Premium Theme - Cross Site Scripting Vulnerability

An xss vulnerability was found in the Wordpress NewsGamer Premium Theme. Usage Info Use your cross site scripting payload Proof of Concept PoC: ======================= wp-content/themes/newsgamer/wp-admin/tinymce/popup.php?popup=alert/xss/ 0day.today 2018-01-08...

CVE-2017-2168

Cross-site scripting vulnerability in WP Booking System Free version prior to version 1.4 and WP Booking System Premium version prior to version 3.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

JVN#96165722: WordPress plugin "WP Booking System" vulnerable to cross-site scripting

The WordPress plugin "WP Booking System" provided by WP Booking System contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of a user who logged-in as an administrator. Solution Update the plugin Update the plugin according to...

PT-2017-3701 · Schneider Electric · Modicon Premium +3

Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon M340 versions affected versions not specified Schneider Electric Modicon Premium versions affected versions not specified Schneider Electric Modicon Quantum versions affected versions not specified Schneider Electri...

PT-2018-19: Authorization Bypass in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200

The specialists of the Positive Research center have detected an Authorization Bypass vulnerability in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200. Vulnerability allows attackers to bypass authorization using requests to CGI functions. How to fix Use the...

PT-2017-3703 · Schneider Electric · Modicon Premium +3

Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon BMXNOR0200 affected versions not specified Schneider Electric Modicon M340 affected versions not specified Schneider Electric Modicon Premium affected versions not specified Schneider Electric Modicon Quantum PLC...