743 matches found
Htcap - web application scanner able to crawl single page application (SPA) in a recursive manner by intercepting ajax calls and DOM changes
htcap is a web application scanner able to crawl single page application SPA in a recursive manner by intercepting ajax calls and DOM changes. Htcap is not just another vulnerability scanner since it's focused mainly on the crawling process and uses external tools to discover vulnerabilities. It'...
CivicRM 4.7b3 SQL Injection
CivicRM extends common CMS platforms WordPress, Drupal with a module to manage Civic campaigns, tracking donors, amounts, and campaign CRM type activity. I tested the WordPress integration of CivicRM 4.7b3 which was found to have blind SQL Injections that allow authenticated users to download...
WAP Music CMS 1.0.2 SQL Injection
========================================================== + Title :- WAP MUSIC CMS - SQL INJECTION + Date :- 24 - MAR - 2016 + Vendor Homepage :- www.wapforum.org + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks :-...
SM Soft Tech CMS 1.0 SQL Injection
========================================================== + Title :- SM SOFT TECH CMS - SQL INJECTION + Date :- 24 - MAR - 2016 + Vendor Homepage :- http://www.smsofttech.net/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks :...
TeamPass 2.1.24 - Multiple Vulnerabilities
Affected Product: TeamPass Vulnerability Type: Multiple XSS,CSRF, SQL injections Fixed in Version: 2.1.25 https://github.com/nilsteampassnet/TeamPass/releases/tag/2.1.25.0 Vendor Website: http://www.teampass.net Software Link: : https://github.com/nilsteampassnet/TeamPass Affected Version: 2.1.24...
Appie v3 - Android Pentesting Portable Integrated Environment
Appie is a software package that has been pre-configured to function as an Android Pentesting Environment on any windows based machine without the need of a Virtual MachineVM or dualboot. It is completely portable and can be carried on USB stick or your smartphone. It is one of its kind Android...
Android Pentesting Portable Integrated Environment: Appie
Appie is a software package that has been pre-configured to function as an Android Pentesting Environment on any windows based machine without the need of a Virtual MachineVM or dualboot. It is completely portable and can be carried on USB stick or your smartphone. It is one of its kind Android...
Open Real Estate 1.15.1 XSS / SQL Injection / Weak Hashing
Introduction: Open Real Estate is an open source CMS for managing estate agent websites. It is written in PHP and uses the YII CMF. It supports multiple languages. It is supported by MonoRay.net The product has a number of commercial support offerings available and an internal market for...
UliCMS v9.8.1 - SQL Injection
Exploit for php platform in category web applications ============================================= MGC ALERT 2016-001 - Original release date: January 26, 2016 - Last revised: February 02, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score...
UliCMS v9.8.1 - SQL Injection
UliCMS v9.8.1 - SQL Injection ============================================= MGC ALERT 2016-001 - Original release date: January 26, 2016 - Last revised: February 02, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I...
UliCMS 9.8.1 SQL Injection
============================================= MGC ALERT 2016-001 - Original release date: January 26, 2016 - Last revised: February 02, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...
UliCMS v9.8.1 - SQL Injection
============================================= MGC ALERT 2016-001 - Original release date: January 26, 2016 - Last revised: February 02, 2016 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...
WordPress Booking Calendar Contact Form 1.1.24 Plugin - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: WordPress appointment-booking-calendar =1.1.24 - Privilege escalation Managing calendars & Persistent XSS Date: 2016-01-28 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit Author: Joaquin...
WordPress Plugin Booking Calendar Contact Form 1.1.23 - Shortcode SQL Injection
WordPress Plugin Booking Calendar Contact Form 1.1.23 - Shortcode SQL Injection Exploit Title: WordPress appointment-booking-calendar =1.1.23 - Shortcode SQL injection Date: 2016-01-24 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit Author: Joaquin Ramire...
WordPress Plugin Booking Calendar Contact Form 1.1.23 - Shortcode SQL Injection
Exploit Title: WordPress appointment-booking-calendar =1.1.23 - Shortcode SQL injection Date: 2016-01-24 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit Author: Joaquin Ramirez Martinez i0 security-lab Software Link:...
WordPress Booking Calendar Contact Form 1.1.23 Plugin - Shortcode SQL Injection
Exploit for php platform in category web applications Exploit Title: WordPress appointment-booking-calendar =1.1.23 - Shortcode SQL injection Date: 2016-01-24 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit Author: Joaquin Ramirez Martinez i0 security-lab...
WordPress Booking Calendar Contact Form 1.1.23 Plugin - Unauthenticated SQL Injection
Exploit for php platform in category web applications Exploit Title: WordPress appointment-booking-calendar =1.1.23 - Unauthenticated SQL injection Date: 2016-01-26 Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ Exploit Author: Joaquin Ramirez Martinez i0akiN...
4a网络教学平台relatedMaterial.jsp resId参数SQL注入漏洞
4a网络教学平台relatedMaterial.jsp resId参数SQL注入漏洞 relatedMaterial.jsp中的resid参数存在注入 可以用sqlmap直接跑。 这个是正常的。 这个是不正常的。我也是醉了。...
V5shop 在cart.aspx处的参数spikeid存在SQL注入漏洞
举例： 通过谷歌搜索inurl:productpic.aspx,因为cart.aspx是需要登录才可以正常访问，但是注入的时候毫无影响。 案例： http://www.wolifu.com/cart.aspx?act=spikebuy&spikeid=3 D:\sqlmappython sqlmap.py -u "http://www.wolifu.com/cart.aspx?act=spikebuy&spik eid=3" -p "spikeid" | | 1.0-dev-nongit-20150806 | -| . | | | .'| . | || |||||,| | || ||...