WordPress Ajax Search Pro Remote Code Execution

------------------------------------------------------------------------------ WordPress ajax-search-pro Plugin Remote Code Execution ------------------------------------------------------------------------------ - Plugin Link:...

WordPress Ajax Search Lite Plugin <= 3.1 - Remote Code Execution

This vulnerability allows any registered user to execute any function he wants. Solution Upgrade the plugin...

WordPress Download Manager 2.7.2 Privilege Escalation

Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation Date: 24-11-2014 Software Link: https://wordpress.org/plugins/download-manager/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps CVE: CVE-2014-9260 1...

A common Site Management System any user login/SQL injection/GetShell vulnerabilities source code analysis-vulnerability warning-the black bar safety net

Brief description: This system is not open source, most of the universities in use, turn the source off at the next Detailed description: 0x00 General case: code area Manufacturer: Rio Tinto tech Official website: http://www.ltpower.net/ The main is to do the educational products of the...

WordPress Duplicator 0.5.8 Privilege Escalation

Exploit Title: Duplicator 0.5.8 Privilege Escalation Date: 21-11-2014 Software Link: https://wordpress.org/plugins/duplicator/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Every registered user can crea...

WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload

...

WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload

WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload...

WordPress Shopping Cart 3.0.4 - Unrestricted File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Shopping Cart 3.0.4 Unrestricted File Upload Date: 29-10-2014 Software Link: https://wordpress.org/plugins/wp-easycart/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

Cart66 Pro <= 1.5.3 - Authenticated Arbitrary File Disclosure

Ability to change settings with a registered non-admin user allows us to trigger an Arbitrary File Disclosure vulnerability with any path of our choosing. One limitation with this vulnerability is that the target user in the PoC, ‘test’ needs to have an account on the Cart66 installation...

WordPress Ecommerce Cart66 Lite Plugin - Blind SQL Injection

Because of this vulnerability in WordPress Ecommerce Cart66 Lite plugin , shortcodeProductsTable is accessible for every registered user. Solution Update to version 1.5.2...

WordPress Plugin Download Manager 2.7.2 - Privilege Escalation

WordPress Plugin Download Manager 2.7.2 - Privilege Escalation Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation Date: 24-11-2014 Software Link: https://wordpress.org/plugins/download-manager/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

Cicada-known Enterprise Portal system v2. 5. 1 to bypass the patch to continue injection-vulnerability warning-the black bar safety net

/system/module/user/model.php public function update$account / If the user want to change his password. / if$this-post-password1 != false $this-checkPassword; ifdao::isError return false; $password = $this-createPassword$this-post-password1, $account; $this-post-set'password', $password; $user =...

Deonixscripts Templates Management 1.3 - SQL Injection Vulnerability

No description provided by source. -------------------------------------------------------------------------- Deonixscripts Templates Management Version 1.3 SQL Injection Vulnerability -------------------------------------------------------------------------- + Author : d3b4g + Email :...

Amtote Homebet 0 Account Information Brute Force Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3371/info Homebet is an internet based betting application that is developed by Amtote International. A vulnerability exists in Homebet which could enable a non-registered user to confirm the validity of possible legitima...

MyDMS 1.4 - SQL Injection Vulnerability And Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10996/info MyDMS is reportedly susceptible to both a directory traversal vulnerability and an SQL injection vulnerability. The SQL injection vulnerability is present because a script improperly sanitizes user-supplied dat...

PHP AGTC-Membership System <= 1.1a Arbitrary Add-Admin Exploit

No description provided by source. !/usr/bin/perl Note: adduser.php is accessable to a guest/any-user, but if you access through a browser you cant add admin, theres a hidden POST buried in the script, which contains the userlevel. Note: alot of sites run this script and they remove the powered b...

Apple Mac OS X Server 10.5 - Wiki Server Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/28278/info Apple Mac OS X Server Wiki Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting this issue allows an attacker to access arbitrary...

Joomla JE Job Component com_jejob LFI Vulnerability

No description provided by source. Name : Joomla comjejob LFI Vulnerability Date : june, 26 2010 Critical Level : HIGH Vendor Url : http://joomlaextensions.co.in/jobcomponent/ Google Dork: inurl:comjejob Price:$25.00 Author : Sid3^effects aKa HaRi shellc99atyahoo.com special thanks to : r0073r...

ILIAS 4.4.1 - Multiple Vulnerabilities

No description provided by source. ============================================================== Title ...| Multiple vulnerabilities in ILIAS Version .| ilias-4.4.1.zip Date ....| 21.02.2014 Found ...| HauntIT Blog Home ....| www.ilias.de...

Cybozu Remote Service Manager vulnerable to session fixation

Overview Remote Service Manager provided by Cybozu,Inc. is a software to access on-premise systems such as Cybozu products via "Cybozu Remote Service". Remote Service Manager contains a session fixation vulnerability. Impact A remote, unauthenticated attacker may impersonate a registered user. As...