206 matches found
Heybbs 1.2 no***_de***.php file has SQL injection vulnerability
HEYBBS micro-community is a front-end based on bootstrap+jq+css, back-end php+mysql development of micro-community program. A SQL injection vulnerability exists in the Heybbs 1.2 node.php file, which can be exploited by an attacker to obtain sensitive information from the database...
Arbitrary File Upload Vulnerability in Guojiz
Guojiz is a light community system based on layui front-end framework and thinkphp. Guojiz has an arbitrary file upload vulnerability, which can be exploited by an attacker to upload any type of image, such as a php Trojan horse, when editing a forum post or adding a comment via the upload image...
Arbitrary File Upload Vulnerability in NewLogo Online Education Software
NewLogo online education software, relying on ThinkPHP5 + layui two major frameworks, is one of the few open source online education software. NewLogo Online Education Software suffers from an arbitrary file upload vulnerability, which can be exploited by an attacker to upload a php file that can...
fileGPS - A Tool That Help You To Guess How Your Shell Was Renamed After The Server-Side Script Of The File Uploader Saved It
Introduction When you upload a shell on a web-server using a file upload functionality, usually the file get renamed in various ways in order to prevent direct access to the file, RCE and file overwrite. fileGPS is a tool that uses various techniques to find the new filename, after the server-sid...
Zomato: [www.zomato.com] Blind XSS in one of the admin dashboard
Summary: Admin dasboard ████ from user has XSS Vul Steps To Reproduce: 1. Login ██████ 1. Go to ███ function and intercept request Post data: "/zomato.php?c=zomatoxss" / POST ████ HTTP/1.1 X-Zomato-App-Version-Code: 5610001 ██████████ ███████ X-Zomato-API-Key: ███████ X-App-Language:...
File upload vulnerability in frontend of sentcms v3.0.170127
SentCMS website management system is a simple and easy-to-use website management system created by Nanchang Tengshu Technology Co. SentCMS v3.0.170127 has a file upload vulnerability, due to the system fails to strictly detect the editor function when uploading files. A remote attacker can use th...
N-Media file uploader vulnerability in handling uploaded files
Overview N-Media file uploader is a plugin for WordPress. N-Media file uploader contains a vulnerability CWE-264 in the way it handles uploaded files. As a result, an arbitrary PHP script which is uploaded may be executed. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC...
EasyPHPCalendar 6.1.5/6.2.x calendar.php serverPath Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/14131/info EasyPHPCalendar is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these...
PhotoGal 1.0/1.5 News_File Remote File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14190/info PhotoGal is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. Successful exploitation of this issue will allow an attacker...
PHP <=5.3 - preg_match() full path disclosure
No description provided by source. MajorSecurity Advisory 57PHP =5.3 - pregmatch full path disclosure Details ======= Product: PHP =5.3 Security-Risk: moderated Remote-Exploit: yes Vendor-URL: http://www.php.net/ Vendor-Status: informed Advisory-Status: published Credits ============ Discovered b...
FlatNuke 2.5.x Index.PHP Multiple Remote File Include Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/15172/info FlatNuke is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues to...
Grayscale BandSite CMS 1.1 footer.php this_year Parameter XSS
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register from urlparse import urljoin class TestPOCPOCBase: vulID = 'SSV-82196' vul ID version = '1' author = 'fenghh' vulDate =...
Spid 1.3 lang_path File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/14208/info SPiD is a gallery management application written in PHP. SPiD is prone to a remote file include vulnerability, due to lack of validation of user input. An attacker may leverage this issue to execute arbitrary...
Grayscale BandSite CMS 1.1 login_header.php the_band Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/20137/info Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. These issues may allow an attacker to access sensitive informatio...
ezUpload 2.2 customize.php path Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/14534/info ezUpload is affected by multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these issues ...
EasyPHPCalendar 6.1.5/6.2.x datePicker.php serverPath Parameter Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/14131/info EasyPHPCalendar is prone to multiple remote file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these...
MySource 2.14 Span.php PEAR_PATH Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/15133/info MySource is prone to multiple remote and local file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these...
PHP Advanced Transfer Manager 1.21 Arbitrary File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/13691/info PHP Advanced Transfer Manager is prone to an arbitrary file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue...
Grayscale BandSite CMS 1.1 bio_content.php the_band Parameter XSS
No description provided by source. source: http://www.securityfocus.com/bid/20137/info Grayscale BandSite CMS is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data. These issues may allow an attacker to access sensitive informatio...
MySource 2.14 mimeDecode.php PEAR_PATH Remote File Inclusion
No description provided by source. source: http://www.securityfocus.com/bid/15133/info MySource is prone to multiple remote and local file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage any of these...