Ad Manager Pro 4 - Local File Inclusion

Ad Manager Pro 4 - Local File Inclusion -=--------------------ADVISORY-------------------=- Ad Manager Pro v. 4 Author: Corrado Liotta Aka CorryL [email protected] -=-----------------------------------------------=- -=+ Application: Ad Manager Pro -=+ Version: 4 -=+ Vendor's URL:...

NeoInvoice Blind SQL Injection

NeoInvoice is a multi-tenant open source invoicing system, that currently contains an unauthenticated blind SQL injection condition in signupcheck.php. The input for the value field isn't being properly sanitized, and is used in string concatenation to create the SQL query. See here for the...

WordPress Plugin MoodThingy Widget 0.8.7 - Blind SQL Injection

Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection Date: 7/2/12 Exploit Author: Chris Kellum Vendor Homepage: http://www.moodthingy.com/ Software Link: http://downloads.wordpress.org/plugin/moodthingy-mood-rating-widget.0.8.7.zip Version: 0.8.7 =====================...

Etano 1.x Cross Site Scripting

OVERVIEW Etano 1.x versions are vulnerable to Cross Site Scripting. 2. BACKGROUND The community builder script we provide - Etano - was built entirely based on requests from customers of our previous dating package Dating Site Builder. Almost every feature ever requested was built into Etano to...

WordPress Plugin ucan post 1.0.09 - Persistent Cross-Site Scripting

Exploit Title: Wordpress uCan Post plugin window.alertdocument.cookie Email field is not sanitized but can it will check for a valid email address so the maximum result will be a reflected xss POC: [email protected]'"window.alertdocument.cookie Post Title is not sanitized and it's injectable with a...

Phorum 'admin.php' Cross-Site Scripting Vulnerability

This host is running Phorum and is prone to cross-site scripting vulnerability. OpenVAS Vulnerability Test $Id: gbphorumadminxssvuln.nasl 7044 2017-09-01 11:50:59Z teissa $ Phorum 'admin.php' Cross-Site Scripting Vulnerability Authors: Madhuri D Copyright: Copyright c 2011 Greenbone Networks GmbH...

PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Vulnerability

------------------------------------------------------------------- PmWiki = 2.2.34 pagelist Remote PHP Code Injection Vulnerability ------------------------------------------------------------------- author...............: Egidio Romano aka EgiX mail.................: n0b0d13satgmaildotcom...

Support Incident Tracker <= 3.65 (translate.php) Remote Code Execution Vulnerability

Support Incident Tracker = 3.65 translate.php Remote Code Execution Vulnerability author...............: Egidio Romano aka EgiX mail.................: n0b0d13satgmaildotcom software link........: http://sitracker.org/ affected versions....: from 3.45 to 3.65 - vulnerable code in /translate.php 23...

osCommerce - Arbitrary File Upload File Disclosure

osCommerce - Arbitrary File Upload File Disclosure source: https://www.securityfocus.com/bid/50301/info osCommerce is prone to a remote file upload and a file disclosure vulnerability. The issues occur because the application fails to adequately sanitize user-supplied input. An attacker can explo...

Ferdows CMS Pro <=1.1.0 Multiple Vulnerabilities

Exploit for asp platform in category web applications www.BugReport.ir AmnPardaz Security Research Team Title: Ferdows CMS Pro =1.1.0 Multiple Vulnerabilities Vendor: www.fcms.ir Exploit: Available Vulnerable Version: 1.1.0 Pro Impact: Medium Original Advisory: http://www.bugreport.ir/index77.htm...

Plogger 1.0 RC1 - gallery_name Cross-Site Scripting

Plogger 1.0 RC1 - galleryname Cross-Site Scripting source: https://www.securityfocus.com/bid/47329/info Plogger is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in th...

phpBugTracker <= 1.0.5 Multiple XSS Vulnerabilities - Active Check

phpBugTracker is prone to multiple reflected cross-site scripting XSS vulnerabilities. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...

BMForum Myna 6.0 SQL Injection

Author: Stephan Sattler Software Website: http://www.bmforum.com/ Software Link: http://www.bmforum.com/down/ Required: magic quotes = Off Vulnerability /add-on/jsviewnew.php line 20++: $length = $GET'length'; $forumid = $GET'forumid'; $num = $GET'num'; $forumnum=$forumid; .... $query = "SELECT...

eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting

Exploit Title: Eventum 2.3.1 stored XSS Date: 19-2-2011 Author: Saif El-Sherei Software Link: https://code.launchpad.net/eventum Version: Eventum 2.3.1 Tested on: FF 3.0.15, IE 8 Vendor notification: vendor notified, awaiting response Info: Eventum is a user-friendly and flexible issue tracking...

PivotX < 2.3.2 Multiple XSS Vulnerabilities

PivotX is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Social Share 2010-06-05 Cross Site Scripting

www.eVuln.com advisory: "search" - Non-persistent XSS in Social Share Summary: http://evuln.com/vulns/169/summary.html Details: http://evuln.com/vulns/169/description.html -----------Summary----------- eVuln ID: EV0169 Software: Social Share Vendor: n/a Version: 2010-06-05 Critical Level: low Typ...

Wernhart Guestbook Cross Site Scripting

New eVuln Advisory: Multiple XSS in Wernhart Guestbook Summary: http://evuln.com/vulns/150/summary.html Details: http://evuln.com/vulns/150/description.html -----------Summary----------- eVuln ID: EV0150 Software: Wernhart Guestbook Vendor: Carl A. Wernhart Version: 2001.03.28 Critical Level: low...

AxsLinks 0.3 Cross Site Scripting

New eVuln Advisory: URL and Title XSS in AxsLinks http://evuln.com/vulns/139/summary.html -----------Summary----------- eVuln ID: EV0139 Software: AxsLinks Vendor: AXScripts Version: 0.3 Critical Level: medium Type: Cross Site Scripting Status: Unpatched. No reply from developers PoC: Not availab...

Front Accounting 2.3RC2 - Multiple SQL Injections

Advisory Name: Multiple SQL Injections in Front Accounting Internal Cybsec Advisory Id: 2010-1003-Multiple SQL Injections in Front Accounting Vulnerability Class: SQL Injection Affected Applications: Front Accounting v2.3RC2; other versions may also be affected. Affected Platforms: Any running...

Aspect Ratio CMS - Blind SQL Injection

Author: Stephan Sattler // http://www.solidmedia.de Software Website: http://www.meso.net Software Link: http://www.meso.net/aspekt-ratio Dork: inurl:w3.php?nodeId= Vulnerability Explanation: $GET"nodeId" isn't sanitized before executing the database query. An attacker can use this for a blind SQ...