Smart PHP Poll - Auth Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: Smart PHP Poll Auth Bypass Vulnerability Google Dork: Copyright Smart PHP Poll. All Rights Reserved. Exploit Author: Mr.tro0oqy from Yemen Email : email protected Download Script...

SQL Injection Vulnerability in VOLANS SR Internet Behavior Audit Gateway of Chengdu Flying Fish Star Technology Co.

VOLANS SR Internet Behavior Audit Gateway of Chengdu Flyingfish Star Technology Co., Ltd. is designed for small and medium-sized enterprises, providing perfect Internet behavior management, intelligent bandwidth management and multi-line load balancing solutions. SQL injection vulnerability exist...

Wordpress MainWP Child Plugin 2.0.9.1 /class/MainWPChild.class.php 登录绕过漏洞

/class/MainWPChild.class.php $this-postswheresuffix = ''; $this-commentsandclauses = ''; addaction'templateredirect', array$this, 'templateredirect'; addaction'init', array&$this, 'parseinit'; addaction'adminmenu', array&$this, 'adminmenu'; addaction'admininit', array&$this, 'admininit';...

Betster SQL Injection Vulnerability

Betster aka PHP Betoffice is a suite of software for creating online casinos based on PHP, MySQL and JavaScript. A SQL injection vulnerability exists in Betster version 1.0.4, which stems from the failure of the showprofile.php or categoryedit.php scripts to adequately filter the 'id' parameter;...

Sql injection

Multiple SQL injection vulnerabilities in Betster aka PHP Betoffice 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 showprofile.php or 2 categoryedit.php or 3 username parameter in a login to index.php...

CVE-2015-0885

checkpw 1.02 and earlier allows remote attackers to cause a denial of service infinite loop via a -- dash dash in a username...

DEBIAN-CVE-2015-0885

checkpw 1.02 and earlier allows remote attackers to cause a denial of service infinite loop via a -- dash dash in a username...

CVE-2015-0885

checkpw 1.02 and earlier allows remote attackers to cause a denial of service infinite loop via a -- dash dash in a username...

UBUNTU-CVE-2015-0885

checkpw 1.02 and earlier allows remote attackers to cause a denial of service infinite loop via a -- dash dash in a username...

CVE-2015-0885

checkpw 1.02 and earlier allows remote attackers to cause a denial of service infinite loop via a -- dash dash in a username...

CVE-2015-2103

Cross-site scripting XSS vulnerability in the admin-login panel admin/index.cgi in Cosmoshop allows remote attackers to inject arbitrary web script or HTML via the username field uname parameter...

Akeneo PIM Cross Site Scripting

Affected software: Akeneo Online Demo Type of vulnerability: stored xss URL: http://www.akeneo.com/demo/ Discovered by: Provensec Website: http://www.provensec.com Description:Akeneo is an open source Product Information Management PIM system designed for retailers looking for efficient answers t...

Solarwinds Orion AccountManagement.asmx GetAccounts Admin Creation

This module exploits a stacked SQL injection in order to add an administrator user to the SolarWinds Orion database. Module Options msf use auxiliary/gather/solarwinds/orionsqli msf undefinedorionsqli show actions ...actions... msf undefinedorionsqli set ACTION msf undefinedorionsqli show options...

tipask注入漏洞

简要描述： sql注入漏洞（2次注入） 详细说明： 官方最新源码测试 在control中answer.php中 追问模块---追问 / function onappend $this-load"message"; $qid = intval$this-get2 ? $this-get2 : intval$this-post'qid'; $aid = intval$this-get3 ? $this-get3 : intval$this-post'aid'; $question = $ENV'question'-get$qid; $answer = $ENV'answer'-get$aid...

phpwind can bypass the verification code to continue the violent crack users, demo demo-a vulnerability warning-the black bar safety net

First came to phpwind official website to see, found phpwind has been updated to 9. 0, website is the latest program ! 1. png Then came the landing place can be seen, the site has CAPTCHA restrictions, sank half） ! 2. png Then pick an account login see, the input error will find that there are th...

SIPhone Enterprise PBX SQL Injection Vulnerability

SIPhone Enterprise PBX is an enterprise switch product. A SQL injection vulnerability exists in SIPhone Enterprise PBX. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands via a username...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FancyFon FAMOC before 3.17.4 allow remote attackers to inject arbitrary web script or HTML via the 1 LoginFormusername to ui/system/login or the 2 order or 3 myorgs to index.php...

shopex 接口设计问题导致某一类用户名密码重置

简要描述： shopex 接口设计问题导致某一类用户名密码重置 详细说明： 看到 shopex 有一个云登录机制，看代码: // 云登陆回调地址 function ecopenloginverify // 签名验证 $token = $this-system-getConf'certificate.token'; $GET'sign' && $this-getcesign$GET, $token == $GET'sign' || exit"签名错误，云登陆无法完成"; // 为登陆者创建账户 $accountMdl =...

Vpersian CMS SQL Injection Vulnerability

Remote SQL injection vulnerabilities in vperisan cms . Exploit Title : Vpersian CMS SQL Injection and Authentication bypass Author : Abolfazl74 Home page Link : http://vpersian.net Date : 03/02/2015 Version: All versions Google dork: intext:"VPersian CMS" email : email protected // Vulnerability...

Sql injection

Multiple SQL injection vulnerabilities in xlinkerz ecommerceMajor allow remote attackers to execute arbitrary SQL commands via the 1 productbycat parameter to product.php, or 2 username or 3 password parameter to admin/index.php...