DEBIAN-CVE-2014-9905

Multiple cross-site scripting XSS vulnerabilities in the Web Calendar in SOGo before 2.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 title of an appointment or 2 contact fields...

Joomla Spider FAQ Lite 1.3.1 SQL Injection

Exploit Title: Joomla! Component Spider FAQ Lite v1.3.1 - SQL Injection Google Dork: inurl:index.php?option=comspiderfaq Date: 16.02.2017 Vendor Homepage: http://web-dorado.com/ Software Buy: https://extensions.joomla.org/extensions/extension/directory-a-documentation/faq/spider-faq-lite/ Demo:...

Fedora 24 : drupal7-title (2017-0d7ef286d1)

7.x-1.0-alpha9 - 7.x-1.0-alpha8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Fedora 25 : drupal7-title (2017-307dcf0411)

7.x-1.0-alpha9 - 7.x-1.0-alpha8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

Joomla! Component JE Auto 1.5 - d_itemid SQL Injection

Joomla! Component JE Auto 1.5 - ditemid SQL Injection Exploit Title: Joomla! Component JE Auto 1.5 - SQL Injection Google Dork: inurl:index.php?option=comjeauto Date: 13.02.2017 Vendor Homepage: http://www.joomlaextension.biz/ Software Buy:...

Domains & Hostings Manager PRO 3.0 - entries Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Domains & Hostings Manager PRO v 3.0 - SQL Injection Google Dork: N/A Date: 12.02.2017 Vendor Homepage: http://endavi.com/ Software Buy: https://codecanyon.net/item/advanced-domains-and-hostings-pro-v3-multiuser/10368735 Demo:...

Domains Hostings Manager PRO 3.0 - entries SQL Injection

Domains Hostings Manager PRO 3.0 - entries SQL Injection Exploit Title: Domains & Hostings Manager PRO v 3.0 - SQL Injection Google Dork: N/A Date: 12.02.2017 Vendor Homepage: http://endavi.com/ Software Buy: https://codecanyon.net/item/advanced-domains-and-hostings-pro-v3-multiuser/10368735 Demo...

[SECURITY] Fedora 25 Update: drupal7-title-1.0-0.7.alpha9.fc25

While working on the new content translation system http://api.drupal.org/api/group/fieldlanguage/7 for Drupal 7, we the Dr upal core i18n team faced the need to convert node titles to the Field API in o rder to make nodes fully translatable. We were not able to make this happen in Drupal 7 core ...

Gram Post 1.0 - SQL Injection

Exploit Title: Gram Post - Instagram Auto Post Multi Accounts with Paypal integration v1.0 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://vtcreators.com/ Software Buy:...

Zigaform - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Zigaform - PHP Form Builder - Contact & Survey v2.9.1 - SQL Injection Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://php-form-builder.zigaform.com/ Software Buy:...

Collabo - Arbitrary File Download

Collabo - Arbitrary File Download Exploit Title: Collabo - TeamBusiness Collaboration Network - Arbitrary File Download Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://321-internet.com/ Software Buy: https://codecanyon.net/item/collabo-teambusiness-collaboration-network/15242543 Demo:...

Collabo TeamBusiness Collaboration Network Arbitrary File Download

Exploit Title: Collabo - TeamBusiness Collaboration Network - Arbitrary File Download Google Dork: N/A Date: 10.02.2017 Vendor Homepage: http://321-internet.com/ Software Buy: https://codecanyon.net/item/collabo-teambusiness-collaboration-network/15242543 Demo:...

Muviko Video CMS - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Muviko Video CMS Script - SQL Injection Google Dork: N/A Date: 08.02.2017 Vendor Homepage: https://muvikoscript.com/ Software Buy: https://codecanyon.net/item/muviko-movie-video-cms/19402086 Demo: https://demo.muvikoscript.com/...

Informatica: Stored XSS via Discussion Title and Send as Email attribute in [marketplace.informatica.com]

POC === 1. Under "Your Stuff" choose to "Create a Discussion/Ask a question" 2. Choose a space to submit your discussion/question. Any space will do. 3. Title your discussion with the payload " 4. Choose "Post message" to publish. 5. View the message as any user. Under "Actions" choose to "Send a...

NewsBee CMS - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: NewsBee CMS – SQL Injection Date: 06.02.2017 Software Link: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937?srank=2 Exploit Author: Kaan KAMIS Contact: iletisimatk2andotcom Website:...

Alstrasoft ProTaxi Enterprise 3.5 - Arbitrary File Upload

Exploit Title: Alstrasoft ProTaxi Enterprise v3.5 Script - Arbitrary File Upload Google Dork: N/A Date: 04.02.2017 Vendor Homepage: http://www.alstrasoft.com/ Software Buy: http://www.alstrasoft.com/protaxi-uber-clone.htm Demo: http://propertycarrots.com/taxi/public/user/signin Version: 3.5 Teste...

CUPS 2.0.3 - Remote Command Execution

CUPS 2.0.3 - Remote Command Execution !/usr/bin/python Exploit Title: CUPS Reference Count Over Decrement Remote Code Execution Google Dork: n/a Date: 2/2/17 Exploit Author: @0x00string Vendor Homepage: cups.org Software Link: https://github.com/apple/cups/releases/tag/release-2.0.2 Version: 2.0....

Itech Multi Vendor Script 6.49 - SQL Injection

Exploit Title : Itech Multi Vendor Script - Multiple SQL Injections Author : Yunus YILDIRIM Th3GundY Team : CT-Zer0 @CRYPTTECH - https://www.crypttech.com Website : http://www.yunus.ninja Contact : [email protected] Vendor Homepage : http://itechscripts.com/ Software Link :...

Informatica: [marketplace.informatica.com]- Stored XSS on Image title and Edit Property

By uploading and image with the title of ".jpg and allowing anyone to edit the Document under collaboration settings, XSS can be triggered by any user attempting to edit the document. POC ==== 1. Log into marketplace and go to profile page. Select New Document 2. Choose to upload document and...

Property Listing Script - propid Blind SQL Injection

Property Listing Script - propid Blind SQL Injection Exploit Title: Property Listing Script – Time-Based Blind Injection Date: 02.02.2017 Vendor Homepage: http://phprealestatescript.org/ Software Link: http://phprealestatescript.org/property-listing-script.html Exploit Author: Kaan KAMIS Contact:...