Ultimate Member 1.2.98-1.2.994 - Reflected Cross-Site Scripting (XSS)

The Ultimate Member plugin utilizes the Redux Framework. The Redux Framework includes a script named ‘class.p.php’, which acts as a HTTP proxy. Utilizing this script, it is possible to trigger a Reflected XSS attack, by loading data from a location controlled by the attacker. The data from this...

WordPress Ultimate Member Plugin <= 1.2.994 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability, because attackers load data from a location. After that, data from that location is output on the target domain and JavaScript is executed under the context of the current user of the site. Solution Update the plugin...

WebDrive 12.2 (Build #4172) - Remote Buffer Overflow

!/usr/bin/python Exploit Title:WebDrive Buffer OverFlow PoC Author: metacom Vendor Homepage: http://www.webdrive.com/products/webdrive/ Software Link: https://www.webdrive.com/products/webdrive/download/ Version: 12.2 build 4172 32 bit Date found: 31.05.2015 Date published: 31.05.2015 Platform:...

WordPress Exquisite - Ultimate Newspaper Plugin Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL.WordPress Exquisite - Ultimate Newspaper is a wordpress based news magazine theme. WordPress Exquisite - Ultimate Newspaper suffers from a cross-site scripting...

Encaps PHP/Flash Gallery 2.3.22s Database Puffing Up Exploit

Hi guys, ref: http://www.milw00rm.com/exploits/5179 !/usr/bin/perl -w Title : Encaps PHP/Flash Gallery 2.3.22s Database Puffing Up Exploit Vendor : http://www.encaps.net Download : http://sourceforge.net/projects/encapsnet/files/ Author : ZoRLu / [email protected] Website : milw00rm.com /...

Avsarsoft Matbaa Script - Multiple Vulnerabilities

Title : Avsarsoft Matbaa Script - Multiple Vulnerabilities Author : ZoRLu / [email protected] Website : milw00rm.com / milw00rm.net / milw00rm.org Twitter : https://twitter.com/milw00rm or @milw00rm Test : Windows7 Ultimate Discovery : 15/04/15 Publish : 23/04/15 Thks : exploit-db.com,...

WordPress Exquisite Ultimate Newspaper Theme <= 1.3.3 - Cross Site Scripting

Because of this vulnerability, an attacker can inject arbitrary web script or HTML. Solution Update the theme...

CSRF/XSS In Ultimate Profile Builder by CMSLive Wordpress Plugin

================================================================ CSRF/Stored XSS Vulnerability in Ultimate profile Builder Plugin ================================================================ . contents:: Table Of Content Overview ======== Title :CSRF and Stored XSS Vulnerability in Ultimate...

WordPress Plugin Ultimate Profile Builder 2.3.3 - Cross-Site Request Forgery

WordPress Plugin Ultimate Profile Builder 2.3.3 - Cross-Site Request Forgery ================================================================ CSRF/Stored XSS Vulnerability in Ultimate profile Builder Plugin ================================================================ . contents:: Table Of...

WordPress Plugin Ultimate Profile Builder 2.3.3 - Cross-Site Request Forgery

================================================================ CSRF/Stored XSS Vulnerability in Ultimate profile Builder Plugin ================================================================ . contents:: Table Of Content Overview ======== Title :CSRF and Stored XSS Vulnerability in Ultimate...

WordPress Ultimate Product Catalogue 3.1.2 SQL Injection

-------- ISSUE 1: Exploit Title: Unauthenticated SQLi in ItemID POST parameter on Ultimate Product Catalogue wordpress plugin Google Dork: inurl:"SingleProduct" intext:"Back to catalogue" intext:"Category", inurl:"/wp-content/plugins/ultimate-product-catalogue/product-sheets/" Date: 22/04/2015...

WordPress Ultimate Profile Builder 2.3.3 CSRF / Cross Site Scripting

================================================================ CSRF/Stored XSS Vulnerability in Ultimate profile Builder Plugin ================================================================ . contents:: Table Of Content Overview ======== Title :CSRF and Stored XSS Vulnerability in Ultimate...

WordPress Ultimate Product Catalogue 3.1.2 XSS / CSRF / File Upload

Exploit Title: Multiple Persistent XSS & CSRF & File Upload on Ultimate Product Catalogue 3.1.2 Google Dork: inurl:"SingleProduct" intext:"Back to catalogue" intext:"Category", inurl:"/wp-content/plugins/ultimate-product-catalogue/product-sheets/" Date: 22/04/2015 Exploit Author: Felipe Molina de...

WordPress Ultimate Product Catalogue 3.1.2 XSS / CSRF / File Upload Vulnerabilities

WordPress Ultimate Product Catalogue plugin version 3.1.2 suffers from cross site request forgery, cross site scripting, and file upload vulnerabilities. Exploit Title: Multiple Persistent XSS & CSRF & File Upload on Ultimate Product Catalogue 3.1.2 Google Dork: inurl:"SingleProduct" intext:"Back...

WordPress Plugin Ultimate Product Catalogue 3.1.2 - Multiple Persistent Cross-Site Scripting / Cross-Site Request Forgery / Arbitrary File Upload Vulnerabilities

Exploit Title: Multiple Persistent XSS & CSRF & File Upload on Ultimate Product Catalogue 3.1.2 Google Dork: inurl:"SingleProduct" intext:"Back to catalogue" intext:"Category", inurl:"/wp-content/plugins/ultimate-product-catalogue/product-sheets/" Date: 22/04/2015 Exploit Author: Felipe Molina de...

Ultimate Product Catalogue <= 3.1.4 - Multiple Vulnerabilities

Product Name and Description and File Upload formulary of plugin Ultimate Product Catalog lacks of proper CSRF protection and proper filtering. Allowing an attacker to alter a product presented to a customer or the wordpress administrators and insert XSS in his product name and description. It al...

WordPress Plugin Ultimate Product Catalogue 3.1.2 - Multiple Persistent Cross-Site Scripting Cross-Site Request Forgery Arbitrary File Upload Vulnerabilities

WordPress Plugin Ultimate Product Catalogue 3.1.2 - Multiple Persistent Cross-Site Scripting Cross-Site Request Forgery Arbitrary File Upload Vulnerabilities Exploit Title: Multiple Persistent XSS & CSRF & File Upload on Ultimate Product Catalogue 3.1.2 Google Dork: inurl:"SingleProduct"...

WordPress Exquisite Ultimate Newspaper 1.3.3 Cross Site Scripting

Exploit Title: DOM Cross Site Scripting In Exquisite - Ultimate Newspaper WordPressTheme Google Dork: inurl:/wp-content/exquisite-wp/assets/ Date: 24/04/2015 Exploit Author: Osama Mahmood M4rkm3n Vendor Homepage: http://themeforest.net/item/exquisite-ultimate-newspaper-theme/6264019 Software Link...

Free MP3 CD Ripper 2.6 2.8 (.wav) - SEH Based Buffer Overflow (W7 - DEP Bypass) Exploit

Exploit for windows platform in category local exploits !/usr/bin/python credit to ThreatActor at CoreRed.com Tested on: Windows 7 Ultimate X64 Added DEP Bypass to the exploit naxxo email protected import struct def createropchain: rop chain generated with mona.py - www.corelan.be ropgadgets =...

Exquisite Ultimate Newspaper Theme <= 1.3.3 - DOM Cross-Site Scripting (XSS)

The exquisite-wp WordPress theme was affected by a DOM Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/...