Block WP Login <= 1.3.0 - CSRF and Unauthorised Settings Update

Lack of CSRF and authorisation checks in the bwplconfigureslug function registered as an admininit action could allow attacker via CSRF, or unauthenticated using the admin-ajax.php to change the plugin settings located at /wp-admin/options-permalink.php and disable the protection offered. v1.3.1...

Social Warfare <= 3.5.2 - Unauthenticated Arbitrary Settings Update

Malicious eval is being inserted into the wpoptions table, in the optionname: socialwafaresettings, in the Twitter field. When the plugin is active, it causes the site to issue a JavaScript redirect to porn sites. Deactivating the plugin disables the redirect, but the malicious eval is still in t...

CVE-2018-18416

LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...

CVE-2018-18416

LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...

CVE-2018-17070

An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay...

CVE-2018-14958

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...

BigTree-CMS 4.2.x < 4.2.17 Multiple Vulnerabilities

Binary data 700143.prm...

CVE-2017-6916

CSRF exists in BigTree CMS 4.1.18 with the nav-social parameter to the admin/settings/update/ page. The Navigation Social can be changed...

Cross site request forgery (csrf)

CSRF exists in BigTree CMS 4.1.18 with the nav-social parameter to the admin/settings/update/ page. The Navigation Social can be changed...

CVE-2017-6917

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed...

CVE-2017-6918

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Navigation Social can be changed...

InfraPower PPS-02-S Q213V1 - Remote Command Execution

InfraPower PPS-02-S Q213V1 - Remote Command Execution InfraPower PPS-02-S Q213V1 Unauthenticated Remote Root Command Execution Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware:...

idev-DigiShop 2.0 Cross Site Request Forgery

Exploit Title: idev-DigiShop 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digishop/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowShowHide...

idev-VacationRentals 1.0 CSRF Vulnerability

Exploit for php platform in category web applications Application Name : idev-VacationRentals 1.0 Vulnerable Type : CSRF Demo : http://idevspot.com/demos/idev-vacationrentals/admin Author : Jonturk75 Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowHide 0day.today 2018-01-02...

idev-DigiVendor 5.0 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: idev-DigiVendor 5.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digivendor/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowHide 0day.today...

idev-DigiMall 2.0 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: idev-DigiMall 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digimall/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowHide 0day.today...

idev-MusicShop 2.0 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: idev-MusicShop 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-musicshop/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowShowHide 0day.tod...

idev-DigiShop 2.0 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: idev-DigiShop 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digishop/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowShowHide 0day.today...

ExtCalendar2 - Cookie Authentication Bypass / Backdoor Upload

ext20username pregmatchall'extcalcookieid = "."', DzCURL$target,0,0 , $prf; $prefix = $prf10; header .. $header = "Cookie: ".$prefix."username=admin ' or '1'= '1; ".$prefix."password=admin ' or '1'= '1;"; check if it's work by looking for logout echo eregi"logout", DzCURL$target,0,$header ? " Log...

Hulihan Applications Amethyst 0.1.5 - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/42253/info Hulihan Applications Amethyst is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code...