keycloak: brute force protection not working for the entire login workflow

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures...

WordPress WP User Manager 2.0.8 SQL Injection

==================================================================== WP User Manager v2.0.8 WordPress Plugin - Time-Based SQL Injection ==================================================================== Exploit Title: WP User Manager v2.0.8 WordPress Plugin - Time-Based SQL Injection Date:...

WordPress WP User Manager 2.0.8 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WP User Manager v2.0.8 WordPress Plugin - Time-Based SQL Injection Author: Socket0x03 Alvaro J. Gene Software Link: https://wordpress.org/plugins/wp-user-manager Plugin: WP User Manager Version: v2.0.8 last version File: login...

WordPress PeepSo 1.11.2 SQL Injection

============================================================ PeepSo v1.11.2 WordPress Plugin - Time-Based SQL Injection ============================================================ Exploit Title: PeepSo v1.11.2 WordPress Plugin - Time-Based SQL Injection Date: 11-09-2018 Category: Webapps Author:...

Grocery Crud 1.6.1 SQL Injection

Exploit Title: Grocery crud 1.6.1 - 'searchfield' SQL Injection Google Dork: n/a Date: 2018-11-05 Exploit Author: Loading Kura Kura Vendor Homepage: https://www.grocerycrud.com/ Software Link: https://www.grocerycrud.com/downloads Version: 1.6.1 Tested on: Win10/Kali Linux CVE : 1. Proof of Conce...

Vulnerable domain identification

Identifying potentially vulnerable Exchange endpoints Module Options msf use auxiliary/scanner/msmail/host/id msf undefinedid show actions ...actions... msf undefinedid set ACTION msf undefinedid show options ...show and set options... msf undefinedid run...

Grapixel New Media 2 - pageref SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Grapixel New Media 2 - 'pageref' SQL Injection Exploit Author: Berk Dusunur Vendor Homepage: http://www.grapixel.com Software Link: http://www.grapixel.com Affected Version: v2 Tested on: MacosX CVE : N/A Proof Of Concept...

Grapixel New Media 2 - pageref SQL Injection

Grapixel New Media 2 - pageref SQL Injection Exploit Title: Grapixel New Media 2 - 'pageref' SQL Injection Exploit Author: Berk Dusunur Google Dork: N/A Type: Web App Date: 2018-10-26 Vendor Homepage: http://www.grapixel.com Software Link: http://www.grapixel.com Affected Version: v2 Tested on:...

Grapixel New Media 2 SQL Injection

Exploit Title: Grapixel New Media 2 - 'pageref' SQL Injection Exploit Author: Berk Dusunur Google Dork: N/A Type: Web App Date: 2018-10-26 Vendor Homepage: http://www.grapixel.com Software Link: http://www.grapixel.com Affected Version: v2 Tested on: MacosX CVE : N/A Proof Of Concept Time-Based s...

Microsoft Active Directory Federated Services (ADFS) User Enumeration Vulnerability

Microsoft Active Directory Federated Services ADFS suffers from a time-based user enumeration vulnerability. + Credits: Joshua Platz aka Binary1985 + CVE ID: Requested + Website: https://github.com/binary1985 + Source:...

Microsoft Active Directory Federated Services (ADFS) User Enumeration

Credits: Joshua Platz aka Binary1985 + CVE ID: Requested + Website: https://github.com/binary1985 + Source: https://raw.githubusercontent.com/binary1985/VulnerabilityDisclosure/master/ADFS-Timing-Attack Vendor: ========================== http://www.microsoft.com Product: =========== Active...

mooSocial Store Plugin 2.6 - SQL Injection

Exploit Title: mooSocial Store Plugin 2.6 - SQL Injection Exploit Author: Andrea Bocchetti Date: 2018-08-28 Google Dork: N/A - Vendor: https://moosocial.com/product/store-plugins/ Software Link: https://moosocial.com/product/store-plugins/ Demo URL: http://addons.moosocial.com/stores Purchase lin...

DamiCMS Elevation of Privilege Vulnerability

DamiCMS is a content management system CMS for building websites quickly. A full-down elevation vulnerability exists in DamiCMS version 6.0.1, which stems from the program's reliance on the 'PHP time' function to generate cookies, and can be exploited to gain administrator privileges by making a...

CVE-2018-16239

An issue was discovered in damiCMS V6.0.1. It relies on the PHP time function for cookies, which makes it possible to determine the cookie for an existing admin session via 10800 guesses...

Twitter-Clone 1 - userid SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable...

Twitter-Clone 1 - 'userid' SQL Injection

Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Date: 2018-08-21 Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable parameters : userid , username 1...

Twitter-Clone 1 - userid SQL Injection

Twitter-Clone 1 - userid SQL Injection Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Date: 2018-08-21 Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable...

WordPress Chained Quiz 1.0.8 Plugin - answer SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection Exploit Author: Çlirim Emini Website: https://www.sentry.co.com Software Link: https://wordpress.org/plugins/chained-quiz/ Version/s: 1.0.8 and below Patched Version:...

WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection

Exploit Title: WordPress Plugin Chained Quiz 1.0.8 - 'answer' SQL Injection Exploit Author: Çlirim Emini Website: https://www.sentry.co.com Software Link: https://wordpress.org/plugins/chained-quiz/ Version/s: 1.0.8 and below Patched Version: 1.0.9 CVE : N/A WPVULNDB:...

Sql injection

There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELOenterprise 9 and 10 and ELOprofessional 9 and 10 that makes it possible to read all database content. The vulnerability exists in the ticket HTTP GET...