Vivaldi 1.4.589.11 DLL Hijacking

Exploit Title: Vivaldi browser DLL Hijacking Author: Ashiyane Digital Security Team Vendor Homepage: https://vivaldi.com/ software link: https://downloads.vivaldi.com/stable/Vivaldi.1.4.589.11.exe Tested on:Windows 7 Date: 13-09-2016...

Oracle VM VirtualBox 4.3.28 - '.ovf' Crash (PoC)

Exploit Title: Oracle VM VirtualBox 4.3.28 Crash Author: sultan albalawi Tested on:win7 open viryualbox --ctrl+i--choose file --double+double+double next ban= '\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x5c\x20\x20\x20\x2d\x20\x20' ban+='\x2d\x20\x20\x2d\x20\x3c\x73\x65\x72\x76\x65\x72\x3e\x20\x20\x2d'...

OneBlog 2.0 Cross Site Scripting

Exploit Title :----------------- : Oneblog v2.0 - postsnew.php - Stored XSS Author :------------------------ : Nassim Asrir Author Company :------------------------ : HenceForth Author Email :------------------------ : [email protected] Google Dork :---------------- : - Date...

ApPHP MicroBlog 1.0.2 Cross Site Request Forgery

Exploit Title : ApPHP MicroBlog 1.0.2 - Cross-Site Request Forgery Add New Author Author : Besim Google Dork : Date : 12/10/2016 Type : webapps Platform : PHP Vendor Homepage : - Software link : http://www.scriptdungeon.com/jump.php?ScriptID=9162 CSRF PoC function submitRequest var xhr = new...

Simple Blog PHP 2.0 - Multiple Vulnerabilities

Simple Blog PHP 2.0 - Multiple Vulnerabilities ===================================================== Simple Blog PHP 2.0 - CSRFAdd Post // Stored XSS ===================================================== Vendor Homepage: http://simpleblogphp.com/ Date: 13 Oct 2016 Demo Link :...

BirdBlog 1.4.0 - (Add New Post) Cross-Site Request Forgery

Exploit for php platform in category web applications document.forms0.submit; !--...

PHP Press Release Cross-Site Scripting Vulnerability

PHP Press Release is a software that allows you to manage your organization's press releases via the web, and the public can access recent releases via the web. A stored cross-site scripting vulnerability exists in the title parameter of the administration.php page of PHP Press Release, which can...

Stored Cross-Site Scripting Vulnerability in the Location of Posted Messages in the Web Version of Xinhao Office Software

Xinhoo builds an Internet-based enterprise management platform for enterprises. A stored cross-site scripting vulnerability exists in the web version of Xinhao Office Software at the location of the published message. Due to the use of ordinary user login xiaoqiao, daqiao, in the " send to "...

XenForo ToggleME 3.1.2 Cross Site Scripting

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: XenForo ToggleME plugin Vendor URL: https://xenforo.com/community/resources/toggleme.137/ Type: Cross-Site Scripting CWE-79 Date found: 2016-09-06 Date published: 2016-09-11 CVSSv3 Score: 5....

SQL Injection Vulnerability in the Title Parameter of the Digital Newspaper System/www/index.php Page of Pleasant Reading Media

Joy Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. There is a SQL injection vulnerability in this product, the vulnerability URL is: /www/index.php?mod=admin&con=deliver&title=1, the vulnerability parameter is: title, the attacker can use the vulnerability to...

WordPress Plugin RB Agency 2.4.7 - Local File Disclosure

WordPress Plugin RB Agency 2.4.7 - Local File Disclosure Exploit Title : WordPress RB Agency 2.4.7 Plugin - Local File Disclosure Exploit Author : Persian Hack Team Vendor Homepage : http://rbplugin.com/ Category Webapps Tested on Win Version : 2.4.7 Date 2016/09/03 PoC The Vulnerable page is...

KV Site Admin CMS 3.0 SQL Injection

Exploit Title : KV Site Admin CMS 3.0 SQL injection Vulnerability Exploit Author : xBADGIRL21 Dork : e.World Technology Ltd. All rights reserved "Admin Area - Version 3.0" Version: 3.0 MyBlog: http://xbadgirl21.blogspot.com Tested on: BackBox skype:xbadgirl21 Video Proof :...

EaseUS CMS Message Storage Type Cross-site Scripting Vulnerability

EECO CMS is a marketing enterprise website system based on SEO development. A stored cross-site scripting vulnerability exists in the EE CMS message, due to the program not filtering the title and so on. Allow attackers to exploit the vulnerability to carry out cross-site attacks...

Ian Dunn: Multiple XSS in Camptix Event Ticketing Plugin

Hi, As discussed in 151561 submitting the report here. I have got some more bugs in Camptix Event Ticketing plugin. Well, the first one is a ticket page xss caused by the Ticket Title And the second one is kind of self-xss, caused by also the Ticket title of the plugin but in the coupons page. I...

OLX: stored XSS in olx.pl - ogloszenie TITLE element - moderator acc can be hacked

Hello, The OLX.PL is vulnerable to stored XSS attack. When adding new advertisement, it is possible to put a payload in its title here I used Titlealert1 I see ads are being pre-moderated, however it can remain uncaught also the length limit in title field is enough to insert into it e.g. a BeEF...

Linux/x86-64 - Ncat Shellcode (SSL, MultiChannel, Persistant, Fork, IPv4/6, Password) (176 bytes)

include include // Exploit Title: Linux 64bit Ncat + SSL + MultiChannel + Persistant + Fork + IPv4/6 + Password 176byte // Date: 7/5/2016 // Exploit Author: CripSlick // Tested on: Kali 2.0 // Version: Ncat: Version 7.01 // email protected // OffSec ID: OS-20614 // http://50.112.22.183/...

Updated PhD Thesis Title

Yesterday I posted Latest PhD Thesis Title and Abstract. One of my colleagues Ben Buchanan subsequently contacted me via Twitter and we exchanged a few messages. He prompted me to think about the title. Later I ruminated on the title of a recent book by my advisor, Dr. Thomas Rid. He wrote Cyber...

XuezhuLi FileSharing Path Traversal

Exploit Title: XuezhuLi FileSharing - Path Traversal Vulnerability Date: 2016-06-23 Exploit Author: HaHwul Exploit Author Blog: www.hahwul.com Vendor Homepage: https://github.com/XuezhuLi Software Link: https://github.com/XuezhuLi/FileSharing/archive/master.zip Version: Latest commit Tested on:...

XuezhuLi FileSharing Cross Site Request Forgery

document.forms.csrfpoc.submit; cat /srv/userlists.txt aaaa csrftest --...

Radiant CMS 1.1.3 Cross Site Scripting

Exploit Title: Radiant CMS 1.1.3 - Mutiple Persistant XSS Vulnerabilities Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Exploit Author Twitter: twitter.com/davidsilveiro Vendor Homepage: http://radiantcms.org/ Software Link: http://radiantcms.org/download/ Date:...