Premium Servers List Tracker 1.0 - SQL Injection

Premium Servers List Tracker 1.0 - SQL Injection Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

html_title - Unsupported - SA-CONTRIB-2017-059

The HTML Title module allows a limited set of HTML markup em, sub, sup, b, i, strong, cite, code, bdi, wbr to be used in node titles. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like ...

EDUMOD Pro 1.3 - SQL Injection

EDUMOD Pro 1.3 - SQL Injection Exploit Title: School Management System | EDUMOD Pro v1.3 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/school-management-system-edumod-pro/19764430?srank=288 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

Premium Servers List Tracker 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Premium Servers List Tracker v1.0 – SQL Injection Date: 02.08.2017 Vendor Homepage: https://codecanyon.net/item/premium-servers-list-tracker/19796599?srank=270 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

Legal Robot: Lack of input validation in e-mail & user name, job title, company name field

Hi, During sign up input validation didn't deploy properly on e-mail & name field. I've tested inputing following e-mail during sign up: hacker%@gmail.com Your system send email to verification the account though the e-mail address is invalid as gmail doesn't allow user to sign up using special...

Cross-site Scripting (XSS)

Bolt CMS is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the user input, allowing a malicious user to inject and execute arbitrary javascript through the Title Field of a new entry...

Joomla CCNewsLetter 2.1.9 SQL Injection

Exploit Title: Joomla Component ccnewsletter 2.1.9 - SQL Injection Date: 07-26-2017 Exploit Author: Shahab Shamsi Vendor Homepage: https://extensions.joomla.org/extension/ccnewsletter/ Version: = 2.1.9 Final Version Tested on: Win,Linux Google Dork: inurl:"index.php?option=comccnewsletter"...

Joomla! Component CCNewsLetter 2.1.9 - sbid SQL Injection

Joomla! Component CCNewsLetter 2.1.9 - sbid SQL Injection "Joomla Component ccnewsletter 2.1.9 - 'sbid' Parameter SQL Injection" Exploit Title: Joomla Component ccnewsletter 2.1.9 - SQL Injection Date: 07-26-2017 Exploit Author: Shahab Shamsi Vendor Homepage:...

Secure Mail: How to edit the MDX file for enabling/disabling the hidden policy.

Enable/Disable the hidden policy for Secure Mail: ex "AutoPopulateusernametitle"...

NEC UNIVERGE UM4730 < 11.8 - SQL Injection

Exploit Title: NEC UNIVERGE UM4730 11.8 SQL injection Vulnerbility: SQL injection login bypass Date: 15-12-2016 Exploit Author: b0x41s Author web: https://www.xrayit.nl Vendor Homepage: https://www.nec-enterprise.com Category: webapps Version: 11.6.0.31 Tested on: Windows server 2008 Description:...

CVE-2017-11419

Fiyo CMS 2.0.7 has SQL injection in /apps/apparticle/controller/editor.php via $POST'id' and $POST'arttitle'...

CVE-2017-11128

Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry...

Cross site scripting

Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry...

CVE-2017-11128

Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry...

PT-2017-11761 · Bolt · Bolt Cms

Name of the Vulnerable Software and Affected Versions: Bolt CMS version 3.2.14 Description: The issue allows stored XSS via text input, as demonstrated by the Title field of a New Entry. This can be exploited by injecting malicious code into the text input fields. Recommendations: For Bolt CMS...

Network OSINT Gathering Tool: XRay

XRay is a tool for network OSINT gathering, its goal is to make some of the initial tasks of information gathering and network mapping automatic. How Does it Work? XRay is a very simple tool, it works this way: 1. It’ll bruteforce subdomains using a wordlist and DNS requests. 2. For every...

Easy File Sharing Web Server 7.2 - GET HTTP Request PassWD Buffer Overflow (DEP Bypass) Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python Exploit Title: Easy File Sharing Web Server 7.2 - GET Buffer Overflow DEP Bypass with ROP Date: 8 July 2017 Exploit Author: Sungchul Park Author Contact: email protected Vendor Homepage: http://www.sharing-file.com Software...

CVE-2015-9104

Cross-site scripting XSS vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via the 1 note title or 2 file name of attachments...

Cross site scripting

Cross-site scripting XSS vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title...