CVE-2017-17891

Readymade Video Sharing Script has CSRF via user-profile-edit.php...

CVE-2017-17893

Readymade Video Sharing Script has XSS via the searchvideo.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter...

CVE-2017-17891

Readymade Video Sharing Script has CSRF via user-profile-edit.php...

WordPress: [BuddyPress 2.9.1] Open Redirect via "wp_http_referer" parameter on "bp-profile-edit" endpoint

Hi, In a similar manner to 228569, it is currently possible to execute authenticated open redirections via the wphttpreferer parameter used in the BuddyPress extended user edit screen. Proof of concept Upon accessing the below URL, please select the "Update Profile" button, then select the "←Back...

urlaubspiraten.de XSS vulnerability

Vulnerable URL: https://www.urlaubspiraten.de/user/profile/travel-alarms/14183/edit Details: Description| Value ---|--- Patched:| Yes, at 11.02.2017 Latest check for patch:| 11.02.2017 21:23 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 17517 VIP website...

Square: XSS on bookfresh

Hi, Xss is triggered on https://www.bookfresh.com/cindex.php/profile/edit/cs/staffmember Payload: %22onmouseover%3Dprompt%281%29%20mik%22 Steps to reproduce Create a new staff and put our payload on the name of the staff. Refresh the page Edit the staff and mouseover to the name of the staff and...

Moodle 2.7 Cross Site Scripting

Title: Moodle 2.7 Persistent XSS Vendor: https://moodle.org/ Moodle advisory: https://moodle.org/mod/forum/discuss.php?d=264265 Researched by: Osanda Malith Jayathissa @OsandaMalith E-Mail: osandacatunseen.is Original write-up: http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xs...

PunBB 1.x Profile.PHP User Profile Edit Module SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14195/info PunBB is affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input through the user profile edit module of the 'profile.php' script...

ZEEJOBSITE 2.0 - Remote File Upload Vulnerability

No description provided by source. ZEEJOBSITE v2.0 remote file Upload author: ZoRLu msn: [email protected] home: www.z0rlu.blogspot.com dork: [email protected] date: 08/11/2008 aha simdi gönderiyorum saat 10:40 : first register to site you add this code your shell to head GIF89a;...

FlexCMS 3.2.1 Cross Site Request Forgery

+---------------------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : FlexCMS 3.2.1 Multiple CSRF Date : 16-03-2012 Author : Ivano Binetti http://www.ivanobinetti.com Software link :...

CVE-2011-5074

Multiple cross-site request forgery CSRF vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script via 1 userprofileedit.p...

Vacation Rental Script v4.0 XSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Vacation Rental Script v4.0 XSRF VULNERABILTY Google Dork: "2006 - 2009 Vacation Rental Script" Date: 24.12.2010 Author: OnurTURKESHAN Software Link: http://www.vacationrentalscript.com/ Version: v.4.0 Tested on: v4.0 TEsted...

Vacation Rental Script 4.0 - Cross-Site Request Forgery

Vacation Rental Script 4.0 - Cross-Site Request Forgery Exploit Title: Vacation Rental Script v4.0 XSRF VULNERABILTY Google Dork: "2006 - 2009 Vacation Rental Script" Date: 24.12.2010 Author: OnurTURKESHAN Software Link: http://www.vacationrentalscript.com/ Version: v.4.0 Tested on: v4.0 TEsted...

Vacation Rental Script 4.0 Cross Site Request Forgery

Exploit Title: Vacation Rental Script v4.0 XSRF VULNERABILTY Google Dork: "2006 - 2009 Vacation Rental Script" Date: 24.12.2010 Author: OnurTURKESHAN Software Link: http://www.vacationrentalscript.com/ Version: v.4.0 Tested on: v4.0 TEsted +WorKs ResPecT My FrienDz :...

Billwerx RC 3.1 XSS / SQL Injection

Billwerx RC v3.1 Multiple Vulnerabilities Found By: mrme Download: http://www.billwerx.com/download.php Tested On: Windows Vista Note: For educational purposes only XSS POC: A regular employee can embed javascript code that could be executed within the context of the admin's browser. If the user...

Unrestricted file upload

Unrestricted file upload vulnerability in editresumenext.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a photo in a profile edit action, then accessing the file via a direct request to jobseekers/logos...

CVE-2008-6913

Unrestricted file upload vulnerability in editresumenext.php in Zeeways ZEEJOBSITE 2.0 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a photo in a profile edit action, then accessing the file via a direct request to jobseekers/logos...

TaskDriver <= 1.3 Remote Change Admin Password Exploit

Exploit for unknown platform in category web applications ====================================================== TaskDriver \n\n", $argv0; exit; list$script, $target, $pass = $argv; $xpl = curlin...

getaphpsite Auto Dealers Remote File Upload Vulnerability

Exploit for unknown platform in category web applications ========================================================= getaphpsite Auto Dealers Remote File Upload Vulnerability ========================================================= geta php cardealers Remote File upload...

ScriptsFeed (SF) Real Estate Classifieds Software - Arbitrary File Upload

ScriptsFeed SF Real Estate Classifieds Software Remote File Upload ---------------------------------------------------------- Discovered By: ZoRLu Date: 13.11.2008 Home: www.z0rlu.blogspot.com contact: [email protected] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : my bug number now: 39 my...