Uzbey: test

test...

Uzbey: Test

aaa...

Uzbey: Test

a...

Uzbey: SQL Injection

https://staging.uzbey.com/rotate-image?fid=2841+and+substringversion,1,1=4 FALSE https://staging.uzbey.com/rotate-image?fid=2841+and+substringversion,1,1=5 TRUE https://staging.uzbey.com/rotate-image?fid=2841+and+1=1+order+by+1-- TRUE...

Uzbey: XSS in 3rd party plugin (not affecting Uzbey's users)

Uzbey currently using a 3rd party solution from sharethis.com to share user's album. It is possible to use this function as a medium to attack sharethis.com's users that using Uzbey service. 1- Create album using XSS payload 2- Share the album using Email function letter icon 3- XSS will execute...

Uzbey: Clickjacking at https://staging.uzbey.com/

hi, i found your site is vulnerable to clickjacking. poc: testing frame opacity: 0.5; border: none; position: absolute; top: 0px; left: 0px; z-index: 1000; window.onbeforeunload = function return " Do you want to leave ?"; site is vulnerable for Clickjacking! by Vineet bhardwaj please check the...

Uzbey: Cross site scripting in type parameter

https://staging.uzbey.com/crop-image?fid=1996&type=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E click the above url and you can able to view the pop up...

Uzbey: CMS Information Disclosure

Hi, I noticed that the CHANGELOG.txt disclose Drupal vesion. It might help an attacker to perform information gathering and help an attacker to find the vulnerabilties from the version. PoC: https://staging.uzbey.com/CHANGELOG.txt...

Uzbey: Cross-site scripting vulnerability detected

It was possible to identify a XSS vuln. at this address: https://staging.uzbey.com parameter: ?q=user...

Uzbey: Missing HSTS (Strict Transport Security)

https://www.ssllabs.com/ssltest/analyze.html?d=https://staging.uzbey.com Reference: http://en.wikipedia.org/wiki/HTTPStrictTransportSecurity https://www.owasp.org/index.php/HTTPStrictTransportSecurity http://dev.chromium.org/sts...

Uzbey: Album image XSS

There's an XSS in the album script caused by insufficient escaping of double quotes. PoC: https://staging.uzbey.com/album/image/679/1139%22%3E%3Ch1%3ESurprise!%3Cimg%20src=0%20onerror=%22alertdocument.domain%22%3E...