Shadow Infosystem Arbitrary File Download Vulnerability

Exploit for php platform in category web applications |||||||||||||||||||||||||||||||||||||||||| |--------------------------------------------------------------| |+ Exploit Title: Shadow Infosystem Arbitrary File Download |+ |+ Exploit Author: Ashiyane Digital Security Team |+ |+ Vendor Homepage:...

CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150

CMS Updater allows to update Drupal core automatically with a subscription service. Access bypass The module does not sufficiently protect the settings page allowing any user with the permission "access administration pages" to change settings. This vulnerability is mitigated by the fact that an...

Drupal 7 driver for SQL Server and SQL Azure - Moderately Critical - SQL Injection - SA-CONTRIB-2015-148

Drupal 7 driver for SQL Server and SQL Azure module has a SQL injection vulnerability. Certain characters aren't properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search. Only sites that use contrib or cust...

Twitter - Moderately Critical - Access bypass - SA-CONTRIB-2015-146

This module enables you to pull in public tweets from Twitter accounts, post messages to Twitter to announce content changes, and authenticate using Twitter. The module doesn't sufficiently check for access when using the Twitter Post submodule to post messages to Twitter and allows a tweet to be...

200 Million WhatsApp Users Vulnerable to vCard Vulnerability

WhatsApp recently claimed to have hit 900 Million monthly active users, but a dangerous security flaw in the web version of the popular instant messaging app puts up to 200 Million of its users at risk. Yes, the web-based extension of WhatsApp is vulnerable to an exploit that could allow hackers ...

WordPress eShop 6.3.13 Cross Site Scripting

" / Exploit : -- alertdocument.cookie setTimeout'form1.submit', 1;...

CVE-2015-6580

Multiple unspecified vulnerabilities in Google V8 before 4.5.103.29, as used in Google Chrome before 45.0.2454.85, allow attackers to cause a denial of service or possibly have other impact via unknown vectors...

WordPress sourceAFRICA 0.1.3 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link...

ownCloud: apps.owncloud.com: Malicious file upload leads to remote code execution

Hello ownCloud Security Team, i am here to report a critical security vulnerability . Proof of concept : https://apps.owncloud.com/CONTENT/content-pre1/171172-1.php5 code source of uploaded file :...

Ctools - Critical - Multiple Vulnerabilities - SA-CONTRIB-2015-141

Cross Site Scripting XSS Ctools in Drupal 6 provides a number of APIs and extensions for Drupal, and is a dependency for many of the most popular modules, including Views, Panels and Entityreference. Many features introduced in Drupal Core once lived in ctools. This vulnerability can be mitigated...

WordPress Avenir-Soft Direct Download 1.0 XSS / CSRF Vulnerability

WordPress Avenir-Soft Direct Download plugin version 1.0 suffers from cross site request forgery and cross site scripting vulnerabilities. Exploit Title: Wordpress Avenir-Soft Direct Download Plug-in XSS/CSRF Exploit Author: Ashiyane Digital Security Team Vendor Homepage:...

Wordpress Avenir-Soft Direct Download Plug-in XSS/CSRF Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Wordpress Avenir-Soft Direct Download Plug-in XSS/CSRF Exploit Author: Ashiyane Digital Security Team Vendor Homepage: https://wordpress.org/plugins/avenirsoft-directdownload/ Date: 2015-08-06 Tested On: Kali Linux - FireFox...

WordPress Monetize 1.03 Cross Site Request Forgery / Cross Site Scripting

Exploit Title : Wordpress Monetize Plug-in XSS/CSRF Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/monetize/ Date: 2015-08-07 Tested On : Kali Linux - FireFox Software Link : https://downloads.wordpress.org/plugin/monetize.zip Version : 1.03...

WordPress Avenir-Soft Direct Download 1.0 XSS / CSRF

Exploit Title: Wordpress Avenir-Soft Direct Download Plug-in XSS/CSRF Exploit Author: Ashiyane Digital Security Team Vendor Homepage: https://wordpress.org/plugins/avenirsoft-directdownload/ Date: 2015-08-06 Tested On: Kali Linux - FireFox Software Link:...

Commerce Commonwealth (CBA) - Moderately Critical - Insufficient Verification of API Data - SA-CONTRIB-2015-136

This module enables you to pay for items on Drupal Commerce, using Commerce Commonwealth payment gateway. The module doesn't sufficiently validate the payment under certain specific scenarios. A malicious user can modify the urls used in gateway interaction with Commbank to make a failed payment...

WebStorm Web Design SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : WebStorm Web Design SQL Injection Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://www.webstorm.ca Google Dork 1 : "Web Design and Hosting by WebStorm" inurl:listingdetail.php?id= Google Do...

Medical Website Design SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Medical Website Design SQL Injection Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://www.medicalpracticewebsitedesign.com/ Google Dork : "Medical Practice Website Design" inurl:.php?newsid...

Seawind Solution Bypass Admin Page Vulnerability

Exploit for php platform in category web applications Exploit Title : Seawind Solution Bypass Admin Page Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://india.seawindsolution.com/ Google Dork : intext:"Design & Developed By Seawind Solution Pvt.Ltd." Date:...

Meinestadt24 SQL Injection Vulnerability

Exploit for php platform in category web applications ------------------------ Exploit Title : Meinestadt24 SQL Injection Vulnerability Exploit Author : Ashiyane Digital Security Team Google Dork One : intext:© 2015 meinestadt24 Google Dork Two : inurl:nachrichten.php?artikelid= Date : 2015-7-25...

wordpress -- XSS vulnerability

Gary Pendergast reports: WordPress versions 4.2.2 and earlier are affected by a cross-site scripting vulnerability, which could allow users with the Contributor or Author role to compromise a site. This was reported by Jon Cave and fixed by Robert Chapin, both of the WordPress security team...