phpATM 1.32 (Windows) - Arbitrary File Upload / Remote Command Execution

?php / Exploit Title : "phpATM = 1.32 Remote Command Execution Shell Upload on Windows Servers" Date : 17/06/2016 Author : Paolo Massenio - pmassenioATgmail Vendor : phpATM - http://phpatm.org/ Version : = 1.32 Tested on : Windows 10 with XAMPP PoF "phpATM is the acronym for PHP Advanced Transfer...

phpmps member.php parameter delete from SQL injection vulnerability

0x01 vulnerability profile phpmps in the page member. php parameter delete since the filter is not strict, resulting in SQL injection vulnerability. 0x02 vulnerability details member.php in the delete logic the presence of injection vulnerabilities. 1The id parameter, as long as not an array it...

DOYO universal Station system 2. 3 /index.php the order of the SQL injection vulnerability

0x01 frame description DOYO universal Station system using PHP and MYSQL development,is a free open source CMS built Station, and enterprise built Station system,can be widely used for personal, corporate, government, Agency and many other website-building. Official homepage: http://wdoyo.com...

Dream Gallery 1.0 - Cross-Site Request Forgery (Add Admin)

Dream Gallery 1.0 - Cross-Site Request Forgery Add Admin...

Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)

Exploit Title: ShellShock On Sun Secure Global Desktop & Oracle Global desktop Google Dork: intitle:Install the Sun Secure Global Desktop Native Client Date: 6/4/2016 Exploit Author: [email protected] Vendor Homepage: http://www.sun.com/ & http://www.oracle.com/ Software Link:...

Java Platform SE 6 U24 HtmlConverter.exe Buffer Overflow

No description provided by source...

Trend Micro - 'CoreServiceShell.exe' Multiple HTTP s

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=775 The main component of Trend Micro Antivirus is CoreServiceShell.exe, which runs as NT AUTHORITY\SYSTEM. The CoreServiceShell includes an HTTP daemon, which is used for redirecting network content inspection among other things...

phpcms v9 逻辑缺陷导致可重置任意用户密码

No description provided by source...

安财软件通用报销系统多处文件下载漏洞

No description provided by source...

Wordpress 4.5.1 Remote Command Execute

来源 http://ricterz.me/,格式稍作整理 ImageMagick ImageMagick 昨天曝出 CVE-2016-3714，Java、PHP 的库也受其影响可参考 https://www.seebug.org/vuldb/ssvid-91446 。其中 PHP 的库 Imagick 应用广泛，波及也大。Wordpress 也就是受此漏洞影响出现了 RCE。 这个漏洞很蠢，ImageMagick 在 MagickCore/constitute.c 的 ReadImage 函数中解析图片，如果图片地址是https://开头的，即调用 InvokeDelegate。...

PHP Imagick 3.3.0 - disable_functions Bypass

Exploit for php platform in category web applications Exploit Title: PHP Imagick disablefunctions Bypass Date: 2016-05-04 Exploit Author: RicterZ email protected Vendor Homepage: https://pecl.php.net/package/imagick Version: Imagick = 5.4 Test on: Ubuntu 12.04 Exploit: $ curl...

Truemag Theme - Unauthenticated Reflected Cross-Site Scripting (XSS)

The truemag WordPress theme was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://WP/?s="%20alertdocument.cookie...

phpmywind 前台留言处存储型XSS漏洞

No description provided by source...

iTop 2.2.1 - CSRF Vulnerability

No description provided by source...

AirOS 6.x - Arbitrary File Upload

EDB-Note Source: https://hackerone.com/reports/73480 Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a unauthenticated user to exploit this...

KPPW 2.5 /control/user/message_notice.php 和 /control/user/message_privite.php SQL注入漏洞

No description provided by source...

MiniMax <= 2.0.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The page-layout-builder WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/page-layout-builder/includes/layout-settings.php?layoutsettingsid="alert1;"...

金窗教务系统 /web/web/kebiao/kebiao.asp 等8处POST注入

No description provided by source...

D-Link DAR-8000/DAR-7000系列上网行为审计网关 任意sql语句执行

No description provided by source...

Bumble: [CRITICAL] Full account takeover using CSRF

Hi , I have found a CSRF issue that allows an attacker to link his gmail , facebook ... or any social account to the victim's account and hijack the whole account. Details: When a user tries to link a gmail account with his account , after he authorizes badoo to use his gmail account he will be...