PT-2022-25535 · Interspire · Interspire Email Marketer

Name of the Vulnerable Software and Affected Versions: Interspire Email Marketer versions prior to 6.5.1 Description: The issue allows for arbitrary file upload through a "create survey and submit survey" operation in surveys submit.php. This can lead to a .php file being accessible under the...

CVE-2018-1000869: Improper Neutralization of Special Elements used in an SQL Command

phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /app/admin/nat/item-add-submit.php that can result in SQL Injection.. This attack appear to be exploitable via Rough user, exploiting the vulnerability to access information he/she does not have access to.. This vulnerability appears to hav...

PT-2018-9591

Name of the Vulnerable Software and Affected Versions: phpIPAM versions prior to 1.4 Description: The issue is related to a SQL Injection flaw that can be exploited to access unauthorized information. The vulnerability is present in the /app/admin/nat/item-add-submit.php file and can be exploited...

PT-2018-14995

Name of the Vulnerable Software and Affected Versions Interspire Email Marketer versions through 6.1.6 Description The issue allows for arbitrary file upload through a "create survey and submit survey" operation in surveys submit.php. This can result in a .php file being accessible under an...

jrtberlin.de XSS vulnerability

Open Bug Bounty ID: OBB-697383 Description| Value ---|--- Affected Website:| jrtberlin.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Design/Logic Flaw

Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags or Description within pligg/submit.php...

CVE-2017-17889

Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags or Description within pligg/submit.php...

CVE-2017-17889: Improper Neutralization of Input During Web Page Generation

Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php, a crafted Homepage string in a profile, or a crafted string in Tags or Description within pligg/submit.php...

chosensites.com XSS vulnerability

Vulnerable URL: http://www.chosensites.com/submit.php?category=Domain%20Name%20System=%22/%3E%3C/script%3E%3Cscript%3Ealert/OPENBUGBOUNTY/;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 09.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly...

Netquery 3.1 submit.php portnum Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/14373/info Netquery is affected by multiple remote vulnerabilities. These issues can allow remote attackers to execute arbitrary commands, disclose sensitive information and carry out cross-site scripting attacks. Netquer...

WordPress SendIt plugin <= 1.5.9 - Blind SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress SendIt plugin = 1.5.9 Blind SQL Injection Vulnerability Google Dork: inurl:wp-content/plugins/sendit/submit.php Date: 2011-08-25 Author: evilsocket evilsocket at gmail dot com Software Link: http://wordpress.org/extend/plugins/sendit/...

extreme-fusion <= 4.02 Remote Code Execution Exploit

No description provided by source. ? //Kacper Settings $exploitname = extreme-fusion = 4.02 Remote Code Execution Exploit; $scriptname = eXtreme-fusion 4.02; $scriptsite = http://extreme-fusion.pl/download-cat16; $dork = 'by eXtreme Crew'; // print ' ::::::::: :::::::::: ::: ::: ::::::::::: ::: :...

CVE-2013-7368: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script or HTML via the gnewtemplate parameter to 1 users/profile.php, 2 articles/index.php, or 3 admin/polls.php; 4 categoryid parameter to news/submit.php; newsid parameter to 5...

CVE-2013-1470

Cross-site scripting XSS vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject arbitrary web script or HTML via the calendartype parameter to submit.php...

CVE-2013-1470: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject arbitrary web script or HTML via the calendartype parameter to submit.php...

CVE-2012-5103: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in action/add-submit.php in Ggb Guestbook 0.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 url or 2 message parameter...

WordPress SendIt plugin <= 1.5.9 Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress SendIt plugin getvar"SELECT COUNT FROM $tableemail where email ='$POSTemailadd' and idlista = '$POSTlista';"; As you can see, $POSTlista parameter is nor validated neither escaped, so you can blind sql inject it using...

WordPress Plugin SendIt 1.5.9 - Blind SQL Injection

Exploit Title: WordPress SendIt plugin getvar"SELECT COUNT FROM $tableemail where email ='$POSTemailadd' and idlista = '$POSTlista';"; As you can see, $POSTlista parameter is nor validated neither escaped, so you can blind sql inject it using $usercount for the boolean condition checking :...

WordPress Plugin SendIt 1.5.9 - Blind SQL Injection

WordPress Plugin SendIt 1.5.9 - Blind SQL Injection Exploit Title: WordPress SendIt plugin getvar"SELECT COUNT FROM $tableemail where email ='$POSTemailadd' and idlista = '$POSTlista';"; As you can see, $POSTlista parameter is nor validated neither escaped, so you can blind sql inject it using...

DDL CMS 1.0 Remote File Inclusion

+============================================================+ | | | DDL CMS 1.0 Multiple Remote File Inclusion Vulnerabilities | | | +============================================================+ | | | Author : HxH | | | | E-Mail : HxHatlivedotat | | |...