CVE-2015-8354

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Ultimate Member WordPress plugin before 1.3.29 for WordPress allows remote attackers to inject arbitrary web script or HTML via the refer parameter to wp-admin/users.php...

CVE-2015-8354

CVE-2015-8354 affects the WordPress Ultimate Member plugin (versions prior to 1.3.29). The root cause is lack of input filtering for the _refer parameter in wp-admin/users.php when update=confirm_delete, enabling an unauthenticated attacker to craft a link that executes arbitrary HTML/script in t...

Ultimate HR System < 1.2 - Directory Traversal / Cross-Site Scripting

Exploit Title: HRM - Workable Zone : Ultimate HR System Last Name Other vulnerable fields include: First Name, Contact Number Unauthenticated Directory Traversal: http://localhost.com/download?type=document&filename=../../../../../etc/passwd Credits & Authors: ================== 8bitsec -...

VX Search Enterprise 10.0.14 Buffer Overflow

!/usr/bin/env python Exploit Title : VX Search Enterprise v10.0.14 Remote Buffer Overflow CVE-2017-13708 Discovery by : Anurag Srivastava and Nipun Jaswal Credtis : Team Pyramid Email : [email protected] Website : www.pyramidcyber.com Discovery Date : 26/08/2017 Software Link :...

DiskBoss Enterprise 8.2.14 Buffer Overflow

!/usr/bin/python Exploit Title : DiskBoss Enterprise v8.2.14 - 'Import Command' Buffer Overflow Discovery by : Anurag Srivastava Email : [email protected] Website : www.pyramidcyber.com Discovery Date : 22/08/2017 Software Link :...

Disk Pulse Enterprise 9.9.16 Buffer Overflow

!/usr/bin/python Exploit Title : Disk Pulse Enterprise 9.9.16 - 'Import Command' Buffer Overflow Discovery by : Anurag Srivastava Email : [email protected] Website : www.pyramidcyber.com Discovery Date : 21/08/2017 Software Link :...

MessengerScan 1.05 - Local Buffer Overflow (PoC) Exploit

Exploit for windows platform in category dos / poc !/usr/bin/python Exploit Title : MessengerScan v1.05 Hostname/IP Field SEH/EIP Overwrite POC Discovery by : Anurag Srivastava Email : email protected Discovery Date : 18/08/2017 Software Link :...

MessengerScan 1.05 SEH / EIP Overwrite Proof Of Concept

!/usr/bin/python Exploit Title : MessengerScan v1.05 Hostname/IP Field SEH/EIP Overwrite POC Discovery by : Anurag Srivastava Email : [email protected] Discovery Date : 18/08/2017 Software Link : https://www.mcafee.com/in/downloads/free-tools/messengerscan.aspx Tested Version :...

Joomla Ultimate Property Listing 1.0.2 SQL Injection

Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/ultimate-property-listing/ Demo: http://demoupl.faboba.com/ Version:...

CVE-2017-12200

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...

CVE-2017-12199

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...

Design/Logic Flaw

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...

CVE-2017-12199

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...

CVE-2017-12199

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...

CVE-2017-12200

The CVE-2017-12200 entry concerns the WordPress plugin Etoile Ultimate Product Catalog (version 4.2.11). A cross-site scripting (XSS) vulnerability exists in the Add Product Manually component, enabling a remote attacker to inject arbitrary web script or HTML. Details across sources confirm the a...

CVE-2017-12200

The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...

CVE-2017-12199

The CVE-2017-12199 entry documents a SQL injection in the WordPress plugin Etoile Ultimate Product Catalog (version 4.2.11). The vulnerability arises via multiple wp-admin/admin-ajax.php POST actions (catalogue_update_order, list-item, video_update_order, image_update_order, tag_group_update_orde...

Joomla! Component Ultimate Property Listing 1.0.2 - SQL Injection

Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/ultimate-property-listing/ Demo: http://demoupl.faboba.com/ Version:...

Joomla Ultimate Property Listing 1.0.2 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software:...