HP Data Protector Media Operations DBServer opcode 0x10 Traversal Arbitrary File Access

HP Data Protector Media Operations is affected by a directory traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Successfully exploiting the issue may allow an attacker to obtain read arbitrary files that could aid in further attacks. %NASLMINLEVEL 70300 C...

Drupal AES encryption File Disclosure

Information disclosure Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Booking Calendar Lite CSRF (change password)

Exploit for php platform in category web applications Exploit Title: Booking Calendar Lite CSRF change password Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/booking-calendar-lite/27644/ Category:: webapps Demo : http://dev.kreci.net/calendar/admin.php Greetz:...

4Images 1.7.7 Cross Site Request Forgery

Title: 4images - Image Gallery Management System - CSRF Change mail user or admin Author: Dmar al3noOoz Mail : wafeesathotmail.com Name : 4images - Image Gallery Management System dork : Google Dork: "4images - Image Gallery Management System" Software Link : http://www.4homepages.de Version: 1.7...

BPowerItaliano CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: BPowerItaliano CSRF Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/viewscript/bpoweritaliano-unique-low-bid-auction-italian-ver/27150/ Category:: webapps Demo :...

idev-TextAds 3.0 CSRF (change e-mail address)

Exploit for php platform in category web applications Exploit Title: idev-TextAds 3.0 CSRF change e-mail address Author: Jonturk75 Vendor or Software Link: http://www.scripts.com/php-scripts/ad-management-programs/idevtextads-30-ad-rotator-sell-text-ads/ Category:: webapps Demo :...

Zend Server 5.6.0 Script Insertion

Exploit for php platform in category web applications 0day.today 2018-01-03...

Bontq - 'user/' URI Cross-Site Scripting

source: https://www.securityfocus.com/bid/52183/info Bontq is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...

Hloun v1.0.x => xss csrf to inject php code

Exploit for php platform in category web applications !/usr/bin/perl Title : Hloun v1.0.x = xss csrf to inject php code Author : Or4nG.M4n Version : 1.0.x Homepage : http://www.hloun.in/ video : http://youtu.be/62H3ojk2c-k Note : : welcome back www.Sec4ever.com : Hloun v1.0.x = xss csrf to inject...

DZ社区动力管理添加

简要描述： 可以添加管理员用户，然后进入后台 进行一系列操作，除了sql命令不能运行。 详细说明： 今天朋友丢了个后台，仔细一看竟然是http://nt.discuz.net ，直接管理员的用户。 漏洞证明： 废话不多说 直接上图...

HP VSA - Remote Command Execution

!/usr/bin/python ''' ================================== Pseudo documentation ================================== ''' HP VSA / SANiQ Hydra client Nicolas Grégoire v0.5 ''' ================================== Target information ================================== ''' HOST = '192.168.201.11' The remote...

Flyspray 0.9.9.6 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Flyspray 0.9.9.6 CSRF Vulnerability Date: 06 Feb 2012 Author: Vaibhav Gupta Software Link: http://flyspray.org/flyspray-0.9.9.6.zip Version: 0.9.9.6 +---+CSRF Add Admin Account after authentication+---+ CSRF Exploit to add ADMIN...

Motigo Forums/Calendar/Guestbook Cross Site Scripting

Exploit Title: Motigo Forums/Calendar/Guestbook Cross Site Scripting Date: 28.01.2012 Author: Sony Software Link: http://motigo.com/ Web Browser : Mozilla Firefox Blog : http://st2tea.blogspot.com PoC: http://st2tea.blogspot.com/2012/01/motigo-forumscalendarguestbook-cross.html...

Discuz 4.0 头像设置处可以持久型脚本

简要描述： Discuz 4.0 头像设置处可以post xss脚本， 可能是个老漏洞了，在内网的论坛上发现的，不知道是否没升级…… 详细说明： Discuz 4.0 头像设置处，先选一个系统自带头像，提交，抓包。 将头像地址【customavatars/190.jpg】替换为xss脚本【javascript:alert/x/】,post提交后，所有头像引用代码辩位;可以成功执行。 不过引号、，等会被替换或编码，必须构造无引号的语句 漏洞证明：...

TinyWebGallery 1.8.3 Remote Command Execution

» TinyWebGallery 1.8.3 Remote Command Execution » --- Date : 05- 01- 2012 » --- Author : Expl0!Ts -------- My Best t34m ----- "BaC , RoBert MilEs , Bl4ckID" » --- Software Link : http://www.tinywebgallery.com/dl.php?file=twglatest » --- Version: n/a » --- Category: php » --- Tested on: wind xp...

Look411.com Cross Site Scripting

WhiteHatZone Vulnerable : http://www.look411.com/ Script : alert'XSS found by Girish Shrimali'; Vulnerable link : http://www.look411.com/?p=numbersearch&q=%3Cscript%3Ealert%28%27XSS+found+by+Girish+Shrimali%27%29%3B%3C%2Fscript%3E&country=US Greetz : Vidit Baxi, Sumit Pareek...

Journal PHP SQL Injection

Exploit Title: Journal PHP SQL Injection Author: Th4 MasK Contact to ; [email protected] Date : 13.12.2011 Platform : Php Google Dork: journal.php?id= Demos Site : http://www.lcoastpress.com/journal.php?id=3 SQL http://www.trinityfoundation.org/journal.php?id=103 SQL...

Stanford.edu Cross Site Scripting

Exploit Title: Stanford.edu Cross Site Scripting Vulnerability Date: 12/11/2011 - 04:00am Author: Ryuzaki Lawlet Website: http://jusryuz.blogspot.com Tested On: WinXP /Win7 Platform: php Email: [email protected] $ Vulnerable : http://www.domain.edu/Ryu/Ryuz/cgi-bin/index.php?photos&event= $...

Websense 7.6 Triton - ws_irpt.exe Remote Command Execution

Websense 7.6 Triton - wsirpt.exe Remote Command Execution source: https://www.securityfocus.com/bid/51086/info Websense Triton is prone to a remote command-execution vulnerability. An attacker can exploit this issue to execute arbitrary commands with SYSTEM-level privileges. Successfully exploiti...

CVE-2011-4405

The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle MITM attack...