8158 matches found
CVE-2015-7386: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 Media Title or 2 Media Subtitle fields...
PT-2015-7544
Name of the Vulnerable Software and Affected Versions Gallery - Photo Albums - Portfolio plugin version 1.3.47 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the...
Joomla Spider Random Article Component - SQL Injection
Exploit Title : Joomla Spider Random Article Component SQL Injection vulnerability Author : Jagriti Sahu AKA Incredible Vendor Link : http://demo.web-dorado.com/spider-random-article.html Date : 22/03/2015 Discovered at : IndiShell Lab Love to : error1046 ^^ ,Team IndiShell,Codebreaker ICA...
ITOP Reflective Cross-Site Scripting Vulnerability
ITOP is an open source web application . ITOP suffers from a reflected cross-site scripting vulnerability. Due to insufficient filtering of input passed to the "/pages/ajax.render.php" script via the "title" HTTP GET parameter, a remote, unauthenticated attacker could trick a logged-in user into...
Shadow Infosystem Arbitrary File Download Vulnerability
Exploit for php platform in category web applications |||||||||||||||||||||||||||||||||||||||||| |--------------------------------------------------------------| |+ Exploit Title: Shadow Infosystem Arbitrary File Download |+ |+ Exploit Author: Ashiyane Digital Security Team |+ |+ Vendor Homepage:...
WordPress ALO EasyMail Newsletter 2.6 CSRF / Cross Site Scripting
Exploit Title: Wordpress ALO EasyMail Newsletter CSRF/XSS Exploit Author: Ashiyane Digital Security Team Vendor Homepage: https://wordpress.org/plugins/alo-easymail/ Software Link: https://downloads.wordpress.org/plugin/alo-easymail.2.6.00.zip Version: 2.6 Date: 2015-09-15 Tested on: windows 7...
Yahoo! Messenger Stack Buffer Overflow Vulnerability
Yahoo! Messenger Yahoo! is a set of instant messaging tools launched by the American company Yahoo! A stack buffer overflow vulnerability exists in Yahoo! Messenger versions 11.5.0.228 and earlier, which can be exploited to cause a denial of service or execute arbitrary code via the 'shortcut' or...
WordPress Car Rental System SQL Injection Vulnerability
Exploit Title : Car Rental System Native WordPress Plugin SQL Injection vulnerability version3.1 Author : Manish Kishan Tanwar AKA error1046 Vendor Link : http://codecanyon.net/item/car-rental-system-native-wordpress-plugin/11758680 Affected Version: below version 3.1 Date : 12/07/2015 Love to :...
PT-2015-3915
Name of the Vulnerable Software and Affected Versions Yahoo! Messenger versions 11.5.0.228 and earlier Description The issue is related to multiple stack-based buffer overflows that can be triggered by remote attackers. This can lead to a denial of service, causing the application to crash, and...
The vulnerability of the Firefox OS operating system allows a hacker to inject arbitrary HTML code.
The vulnerability of the Gaia Search app for the Firefox OS operating system exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code by manipulating the title and search engine field of...
GeniXCMS 0.0.3 - XSS Vulnerabilities
漏洞标题：持续性XSS 厂商主页: genixcms.org 软件链接: genixcms.org 版本: 0.0.3 测试于: windows 7 类别: web应用 厂商:=============================================genixcms.org产品:=====================================================GeniXCMS v0.0.3 是一个基于PHP的管理系统 咨询信息:===================================================多个持续型&反射型...
Cross site scripting
Cross-site scripting XSS vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title...
CVE-2015-6808: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title...
PT-2015-7364
Name of the Vulnerable Software and Affected Versions Drupal Spotlight module versions 7.x-1.x before 7.x-1.5 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with specific permissions to inject arbitrary web script or HTML via a node title. Recommendations...
YesWiki 0.2 - 'squelette' Directory Traversal
Exploit Title: YESWIKI 0.2 - Path Traversal Date: 2015-09-02 Exploit Author: HaHwul Exploit Author Blog: http://www.codeblack.net Vendor Homepage: http://yeswiki.net Software Link: https://github.com/YesWiki/yeswiki Version: yeswiki 0.2 Tested on: Debian Wheezy CVE : none...
SphereFTP Server 2.0 Crash
!/usr/bin/python Exploit Title: SphereFTP Server v2.0 Remote Crash PoC Date: 2015-09-02 Exploit Author: Meisam Monsef [email protected] or [email protected] Vendor Homepage: http://www.menasoft.com/blog/?p=32 Software Link: http://www.menasoft.com/sphereftp/sphereftpwin32v20.zip Version: 2.0...
CVE-2015-6753
Multiple cross-site scripting XSS vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 entity title, related to in-place editing, or a 2 node title...
PT-2015-7337
Name of the Vulnerable Software and Affected Versions Drupal Quick Edit module versions 7.x-1.x before 7.x-1.2 Description The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via an entity title, related to in-place editing, or a node title,...
CVE-2015-6753: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 entity title, related to in-place editing, or a 2 node title...