CVE-2011-1587: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? question mark in a query string,...

CVE-2011-1578

Cross-site scripting XSS vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with...

Rightnow's => Auth Bypass Vulnerability (Shell Upload)

Exploit for php platform in category web applications My + Author : KaCaK Contact : email protected HomePage : http://secureb0x.blogspot.com , http://griadamlar.com Greetz : KnockOut , Mus4llat , Technical and All My Friends Software info |Web App. : Madni Designers Web Portal |Price : Price...

SSN Uploaded By A User via FTP

Binary data 5913.prm...

PYSEC-2011-31

Cross-site scripting XSS vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload...

MultiPowUpload 2.1 Shell Upload

Exploit Title: MultiPowUpload v 2.1 Remote File Upload Vulnerability Author: DIES3L Email: [email protected] Date: 26-1-2011 Software Link: http://www.element-it.com Download Software : http://www.element-it.com/Download/ElementIT.MultiPowUpload3.zip Version: 2.1 Tested on: LiNuX...

SOOP Portal 2.0 - Arbitrary File Upload

SOOP Portal 2.0 - Arbitrary File Upload I N F O Exploit Title: SOOP Portal 2.0 Remote Upload Shell Vulnerability DDate: 05-12-2010 Author: Net.Edit0r Software Link: www.soopportal.com Version: 2.0 Tested on: windows server 2008 Contact: [email protected] [email protected] E X P L O I T 1...

MetInfo 3.0 - 'FCKeditor' Arbitrary File Upload

Exploit Title: MetInfo 3.0 fckeditor File Upload Exploit Date: 02-11-2010 Author: sh3n Software Link: http://www.metinfo.cn/upload/file/metinfo3.0.zip Version: 3.0 Tested on: BT4 Ubuntu, Windows 7 Ultimate Exploit: metinfo.pe/fckeditor/editor/filemanager/connectors/uploadtest.html...

Krojac CMS SQL Injection

Exploit Title: Krojach CMS SQL Injection Vulnerabilities Date found: 6.2010 Author: MikiSoft Email: [email protected] CMS Software Site/Link: http://www.krojac.com Versions affected: All Edit: In latest version this is fixed now... Google dorks: intext:"Skrojio i sašio Krojač" ; intext:"Made...

Content-Disposition: attachment ignored if Content-Type: multipart also present

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting XSS...

Content-Disposition: attachment ignored if Content-Type: multipart also present

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting XSS...

Content-Disposition: attachment ignored if Content-Type: multipart also present

Mozilla Firefox 3.5.x before 3.5.10 and 3.6.x before 3.6.4, and SeaMonkey before 2.0.5, does not properly handle situations in which both "Content-Disposition: attachment" and "Content-Type: multipart" are present in HTTP headers, which allows remote attackers to conduct cross-site scripting XSS...

gpEasy 1.6.1 Cross Site Request Forgery

============================================= gpEasy Date : 04-29-2010 Site : http://www.giudinvx.altervista.org/ Location : Naples, Italy -------------------------------------------------------- Application Info Site : http://www.gpeasy.com/ Version: 1.6.1...

CVE-2008-7157: Undefined Security Weakness

Unrestricted file upload vulnerability in EkinBoard 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading an avatar file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in uploaded/avatars/...

CVE-2009-2914

Cross-site scripting XSS vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2914: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2545

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

Sql injection

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...

CVE-2009-2545

SQL injection vulnerability in Advanced Electron Forum AEF 1.x, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third...