PT-2017-17413

Name of the Vulnerable Software and Affected Versions BigTree CMS version 4.1.18 Description The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the nav-social parameter. This allows an attacker to change the Navigation Social settings. Recommendatio...

CVE-2017-6918: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Navigation Social can be changed...

PT-2017-17412

Name of the Vulnerable Software and Affected Versions BigTree CMS version 4.1.18 Description The issue concerns a CSRF problem. It affects the "admin/settings/update/" page, specifically with the colophon parameter. This allows the Colophon to be changed. Recommendations For BigTree CMS version...

CVE-2017-6915: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. The Colophon can be changed...

CVE-2017-6916: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS 4.1.18 with the nav-social parameter to the admin/settings/update/ page. The Navigation Social can be changed...

CVE-2017-6917: Cross-Site Request Forgery (CSRF)

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed...

InfraPower PPS-02-S Q213V1 - Remote Command Execution

InfraPower PPS-02-S Q213V1 - Remote Command Execution InfraPower PPS-02-S Q213V1 Unauthenticated Remote Root Command Execution Vendor: Austin Hughes Electronics Ltd. Product web page: http://www.austin-hughes.com Affected version: Q213V1 Firmware: V2395S Fixed version: Q216V3 Firmware:...

idev-VacationRentals 1.0 CSRF Vulnerability

Exploit for php platform in category web applications Application Name : idev-VacationRentals 1.0 Vulnerable Type : CSRF Demo : http://idevspot.com/demos/idev-vacationrentals/admin Author : Jonturk75 Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowHide 0day.today 2018-01-02...

idev-DigiShop 2.0 Cross Site Request Forgery

Exploit Title: idev-DigiShop 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digishop/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowShowHide...

idev-DigiShop 2.0 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: idev-DigiShop 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digishop/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowShowHide 0day.today...

idev-DigiVendor 5.0 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: idev-DigiVendor 5.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digivendor/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowHide 0day.today...

idev-DigiMall 2.0 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: idev-DigiMall 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-digimall/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowHide 0day.today...

idev-MusicShop 2.0 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: idev-MusicShop 2.0 CSRF Author: Jonturk75 Vendor or Software Link: http://idevspot.com/ Category:: webapps Demo : http://idevspot.com/demos/idev-musicshop/admin Greetz: Inj3ct0r Exploit DataBase 1337day.com ShowShowHide 0day.tod...

CVE-2012-0990: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/settings/update in DClassifieds 0.1 final allows remote attackers to hijack the authentication of administrators for requests that modify account settings such as the administrator password or email via certain Settings parameters...

PT-2012-2995

Name of the Vulnerable Software and Affected Versions DClassifieds version 0.1 final Description A cross-site request forgery issue exists, allowing remote attackers to hijack administrator authentication for requests that modify account settings, such as the administrator password or email, via...

ExtCalendar2 - Cookie Authentication Bypass / Backdoor Upload

ext20username pregmatchall'extcalcookieid = "."', DzCURL$target,0,0 , $prf; $prefix = $prf10; header .. $header = "Cookie: ".$prefix."username=admin ' or '1'= '1; ".$prefix."password=admin ' or '1'= '1;"; check if it's work by looking for logout echo eregi"logout", DzCURL$target,0,$header ? " Log...

Hulihan Applications Amethyst 0.1.5 - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/42253/info Hulihan Applications Amethyst is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code...

LinPHA 1.3.3 Plugin Maps - Remote Command Execution

LinPHA 1.3.3 Plugin Maps - Remote Command Execution ?php / -------------------------------------------------------------- LinPHA = 1.3.3 maps plugin Remote Command Execution Exploit -------------------------------------------------------------- author...: EgiX mail.....: n0b0d13satgmaildotcom...