CVE-2013-0473

CVE-2013-0473 describes multiple cross-site scripting (XSS) vulnerabilities in IBM Security AppScan Enterprise (versions 5.6 and 8.x prior to 8.7) and IBM Rational Policy Tester (versions 5.6 and 8.x prior to 8.5.0.4). The issue allows remote attackers to inject arbitrary web script or HTML via a...

CVE-2013-0275

Multiple cross-site scripting XSS vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Metasploit Module Released for Patched Honeywell ICS Vulnerability

Metasploit today released an exploit module for a serious vulnerability in Honeywell industrial control system software used to manage everything from HVAC and building access systems, to energy and facilities management processes. The vulnerability was reported by Rapid7 researcher Juan Vazquez ...

CVE-2012-3499

Multiple cross-site scripting XSS vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the 1 modimagemap, 2 modinfo, 3 modldap, 4 modproxyftp, and 5...

CVE-2012-3327

CVE-2012-3327 describes a cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management (versions 6.2–7.5), Maximo Asset Management Essentials (6.2–7.5), Tivoli Asset Management for IT (6.2–7.2), Tivoli Service Request Manager (7.1–7.2), Maximo Service Desk (6.2), CCMDB (7.1–7.2), and S...

CVE-2012-6523

Multiple cross-site scripting XSS vulnerabilities in w-CMS 2.01 allow remote attackers to inject arbitrary web script or HTML via 1 the p parameter in the getMenus function in codes/wcms.php; or the COMMENT parameter in 2 blog.php, 3 guestbook.php, or 4 forum.php in codes/. NOTE: some of these...

SQLiteManager 1.2.4 Remote PHP Code Injection Vulnerability

Exploit for multiple platform in category remote exploits Description: =============================================================== Exploit Title: SQLiteManager 0Day Remote PHP Code Injection Vulnerability Google Dork: intitle:SQLiteManager inurl:sqlite/ Date: 23/01/2013 Exploit Author: RealGa...

SQLiteManager 1.2.4 PHP Code Injection

Description: =============================================================== Exploit Title: SQLiteManager 0Day Remote PHP Code Injection Vulnerability Google Dork: intitle:SQLiteManager inurl:sqlite/ Date: 23/01/2013 Exploit Author: RealGame Vendor Homepage: http://www.Relagame.co.il Software Lin...

SQLiteManager 1.2.4 - Remote PHP Code Injection

!/usr/bin/env python ''' Description: =============================================================== Exploit Title: SQLiteManager 0Day Remote PHP Code Injection Vulnerability Google Dork: intitle:SQLiteManager inurl:sqlite/ Date: 23/01/2013 Exploit Author: RealGame Vendor Homepage:...

PHPLiteAdmin 1.9.3 - Remote PHP Code Injection

PHPLiteAdmin 1.9.3 - Remote PHP Code Injection Exploit Title: phpliteadmin phpliteadmin.php1785: 'When you create a new database, the name you entered will be appended with the appropriate file extension .db, .db3, .sqlite, etc. if you do not include it yourself. The database will be created in t...

PHP Lite Admin 1.9.3 Code Injection

Exploit Title: phpliteadmin phpliteadmin.php1785: 'When you create a new database, the name you entered will be appended with the appropriate file extension .db, .db3, .sqlite, etc. if you do not include it yourself. The database will be created in the directory you specified as the $directory...

PHPLiteAdmin 1.9.3 - Remote PHP Code Injection

Exploit Title: phpliteadmin phpliteadmin.php1785: 'When you create a new database, the name you entered will be appended with the appropriate file extension .db, .db3, .sqlite, etc. if you do not include it yourself. The database will be created in the directory you specified as the $directory...

CVE-2012-5537

The vulnerability CVE-2012-5537 affects the Simplenews Scheduler module for Drupal (6.x-2.x series) prior to 6.x-2.4. An authenticated user with the 'send scheduled newsletters' permission can inject arbitrary PHP code into the scheduling form, which is later executed by cron, enabling code execu...

CVE-2012-5545

The CVE affects the Drupal ShareThis module (7.x-2.x) prior to 7.x-2.5. The vulnerability is an XSS in the handling of JavaScript settings due to insufficient filtering of output. Exploitation requires an authenticated user with the 'administer sharethis' permission. A fixed version is ShareThis ...

CVE-2012-6040

Cross-site scripting XSS vulnerability in users.php in File King Advanced File Management 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/modules/user/users.php in MyBB aka MyBulletinBoard 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditionsusergroup parameter in a search action to admin/index.php...

CVE-2012-5903

The CVE-2012-5903 entry concerns the Simple Machines Forum (SMF) product, specifically version 2.0.2. The vulnerability is a Cross-Site Scripting (XSS) flaw in the scheduled parameter handling of index.php, enabling remote attackers to inject arbitrary web script or HTML. The root cause is an XSS...

ManageEngine ServiceDesk 8.0 Multiple Vulnerabilities

Exploit for php platform in category web applications ManageEngine ServiceDesk 8.0 - Multiple Vulnerabilities Introduction: ============= ServiceDesk Plus integrates your help desk requests and assets to help you manage your IT effectively. It helps you implement ITIL best practices and...

Joomla Component com_jce remote Code Injecion / Execution Exploit (perl)

JCE component for Joomla! could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions by the file.php script. By sending a specially-crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious PHP...

CVE-2011-5220

Cross-site scripting XSS vulnerability in templates/default/Admin/Login.html in PHP-SCMS 1.6.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the lang parameter to index.php...