3110 matches found
PHP Imagick 3.3.0 - disable_functions Bypass
Exploit for php platform in category web applications Exploit Title: PHP Imagick disablefunctions Bypass Date: 2016-05-04 Exploit Author: RicterZ email protected Vendor Homepage: https://pecl.php.net/package/imagick Version: Imagick = 5.4 Test on: Ubuntu 12.04 Exploit: $ curl...
Truemag Theme - Unauthenticated Reflected Cross-Site Scripting (XSS)
The truemag WordPress theme was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://WP/?s="%20alertdocument.cookie...
phpmywind 前台留言处存储型XSS漏洞
No description provided by source...
iTop 2.2.1 - CSRF Vulnerability
No description provided by source...
AirOS 6.x - Arbitrary File Upload
EDB-Note Source: https://hackerone.com/reports/73480 Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a unauthenticated user to exploit this...
MiniMax <= 2.0.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The page-layout-builder WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. http://www.example.com/wp-content/plugins/page-layout-builder/includes/layout-settings.php?layoutsettingsid="alert1;"...
KPPW 2.5 /control/user/message_notice.php 和 /control/user/message_privite.php SQL注入漏洞
No description provided by source...
金窗教务系统 /web/web/kebiao/kebiao.asp 等8处POST注入
No description provided by source...
D-Link DAR-8000/DAR-7000系列上网行为审计网关 任意sql语句执行
No description provided by source...
Bumble: [CRITICAL] Full account takeover using CSRF
Hi , I have found a CSRF issue that allows an attacker to link his gmail , facebook ... or any social account to the victim's account and hijack the whole account. Details: When a user tries to link a gmail account with his account , after he authorizes badoo to use his gmail account he will be...
WordPress Plugin Advanced Video 1.0 - Local File Inclusion
!/usr/bin/env python Exploit Title: Advanced-Video-Embed Arbitrary File Download / Unauthenticated Post Creation Google Dork: N/A Date: 04/01/2016 Exploit Author: evait security GmbH Vendor Homepage: arshmultani - http://dscom.it/ Software Link:...
新为软件E-learning系统 /bos/desktop/RequestOrResponse.aspx /site/ajax/WebSiteAjax.aspx 等多处处sql注入
No description provided by source...
D-Link 2750u/2730u /cgi-bin/webproc 任意文件读取
No description provided by source...
LN5KyLD3PXVFYox
A Remote Browser's Agent XSS is a piece of software that allows a remote "operator" to control a browser as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "XSS" software is usually associated with criminal or malicious activity...
WordPress Plugin Photocart Link 1.6 - Local File Inclusion
Exploit Title: Wordpress Plugin Photocart Link - Local File Inclusion Exploit Author: CrashBandicot @DosPerl Date: 2016-03-27 Google Dork : inurl:/wp-content/plugins/photocart-link/ Vendor Homepage: https://fr.wordpress.org/plugins/photocart-link/ Tested on: MSWin32 Version: 1.6 Vuln file :...
D-Link DWR-932 Firmware 4.00 权限绕过
No description provided by source...
Uber: Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers
Invite codes are 5 alphanumeric lower case characters. This means there are 36 26 + 10 possible options for each space in the invite code. In total this means there are 36^5 or 60,466,176 possible invite codes. Through enumerating through all possible invite codes, one can find the total number o...
cmseasy demo.php 反射型XSS漏洞
No description provided by source...