CVE-2017-18537

The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues...

CVE-2019-15228

FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors...

CVE-2019-15228

FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors...

Design/Logic Flaw

FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors...

WordPress visitors-online plugin SQL injection vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. visitors-online is a plugin for website visitor statistics. A SQL injection vulnerability exists in the WordPress visitors-online...

CVE-2019-15228

CVE-2019-15228 affects FUEL CMS 1.4.4. The XSS is in the Create Blocks section of the Admin console, arising from insufficient input validation in the admin UI. Impact could include cookie theft and other malicious actions, with exploitation possible by authenticated users and also affecting unau...

CVE-2015-9325

The visitors-online plugin before 0.4 for WordPress has SQL injection...

CVE-2015-9325

The CVE-2015-9325 entry corresponds to a SQL injection vulnerability in the WordPress plugin visitors-online (versions prior to 0.4). The vulnerability is triggered via the plugin’s handling of input in SQL context, allowing manipulation of SQL commands (as per the consolidated sources). Impact i...

CVE-2015-9325

The visitors-online plugin before 0.4 for WordPress has SQL injection...

mainevisitorsnetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-576632 Description| Value ---|--- Affected Website:| mainevisitorsnetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

newyorkvisitorsnetwork.com XSS vulnerability

Open Bug Bounty ID: OBB-561403 Description| Value ---|--- Affected Website:| newyorkvisitorsnetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

FineCMS 1.0 Cross Site Scripting / SQL Injection

Exploit Title: FineCMS 1.0 Multiple Vulnerabilities Dork: N/A Date: 29.08.2017 Vendor Homepage : http://mvc.net.pl/ Software Link: https://github.com/andrzuk/FineCMS Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author: sohaip-hackerDZ Author Web:...

FineCMS 1.0 - Multiple Vulnerabilities

FineCMS 1.0 - Multiple Vulnerabilities Exploit Title: FineCMS 1.0 Multiple Vulnerabilities Dork: N/A Date: 29.08.2017 Vendor Homepage : http://mvc.net.pl/ Software Link: https://github.com/andrzuk/FineCMS Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit Author:...

Gaming Google News

Turns out that it's surprisingly easy to game: It appears that news sites deemed legitimate by Google News are being modified by third parties. These sites are then exploited to redirect to the spam content. It appears that the compromised sites are examining the referrer and redirecting visitors...

Cheers to a successful time at Infosec Europe 2017

With over 350 exhibitors, well over 10,000 visitors, and many widely respected speakers, Infosec Europe is one of Europe's biggest security events. The Malwarebytes stand attracted a lot of interested people, even without our robot Zero, who had obligations elsewhere. The new EMEA Channel...

WordPress Plugin Popup by Supsystic 1.7.6 - Cross-Site Request Forgery

WordPress Plugin Popup by Supsystic 1.7.6 - Cross-Site Request Forgery !-- Source: https://sumofpwn.nl/advisory/2016/popupbysupsysticwordpresspluginvulnerabletocrosssiterequestforgery.html Abstract A Cross-site Request Forgery vulnerablity exists in the Popup by Supsystic WordPress Plugin. This...

Visitors Online < 0.4 - SQL Injection

The Visitors Online by BestWebSoft WordPress plugin was affected by a SQL Injection security vulnerability...

Fedora 21 : php-twig-1.20.0-1.fc21 (2015-13423)

1.20.0 2015-08-12 forbid access to the Twig environment from templates and internal parts of TwigTemplate fixed limited RCEs when in sandbox mode deprecated TwigTemplate::getEnvironment deprecated the self variable for usage outside of the from and import tags added TwigBaseNodeVisitor to ease th...

WordPress WP Rollback plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language , the platform supports in PHP and MySQL server set up a personal blog site . WP Rollback is one of the theme rollback plugin . A cross-site scripting vulnerability exists in the WordPress W...

HTTP Client Automatic Exploiter 2 (Browser Autopwn)

This module will automatically serve browser exploits. Here are the options you can configure: The INCLUDEPATTERN option allows you to specify the kind of exploits to be loaded. For example, if you wish to load just Adobe Flash exploits, then you can set Include to 'adobeflash'. The EXCLUDEPATTER...