ApPHP MicroCMS 3.9.5 - Persistent Cross-Site Scripting

ApPHP MicroCMS 3.9.5 - Persistent Cross-Site Scripting Exploit Title :----------------- : ApPHP MicroCMS 3.9.5 - Stored Cross Site Scripting Author :------------------------ : Besim Google Dork :---------------- : - Date :-------------------------- : 12/10/2016 Type :-------------------------- :...

BuilderEngine 3.5.0 - Arbitrary File Upload

Exploit for php platform in category web applications 0day.today 2018-04-14...

Slack: Stored XSS(Cross Site Scripting) In Slack App Name

Hello Slack, This vulnerability is about a Stored Cross Site Scripting Slack Stored XSS In AppApp Name Vulnerable URLEdit App Page https://api.slack.com/apps/appid/general https://api.slack.com/apps/A21B3V9GA/general Vulnerable Parameter = name Note -Its also work on other user as well. Send this...

Shopify: (BYPASS) Open redirect and XSS in supporthiring.shopify.com

Hello, The users can be redirected to some other site which is in control of the attacker from Vulnerable parameter: path= You have a protection here at path= but it bypass the parameter if you add a double slash, like %2F%2F. Let's say user is attacker asked victim to came to this page: :...

Joomla BT Media 1.0 SQL Injection

Exploit Title : Joomla combtmedia - SQL Injection Exploit Author : Persian Hack Team Vendor Homepage : http://extensions.joomla.org/extension/bt-media-gallery Category: Webapps Tested on: Win Version: 1.0 Date: 2016/06/19 PoC: categories0= Parameter Vulnerable To SQL Demo :...

Apache Continuum 1.4.2 - Multiple Vulnerabilities

Exploit Title: Unauthenticated command injection - Apache Continuum Google Dork: inurl::8080/continuum/ Date: 04/06/2016 Exploit Author: David Shanahan @cyberpunksec Contact: http://www.procheckup.com/ Vendor Homepage: https://continuum.apache.org/ Software Link:...

ManageEngine SelfService Plus Cross Site Scripting

Exploit Title: Reflected XSS in ManageEngine SelfService Plus - 0day - Confirmed Google Dork: N/A Date: 29/5/2016 Exploit Author: Mohamed Saeed Contact: http://twitter.com/krmalab Website: http://www.dts-solution.com Vendor Homepage: https://www.manageengine.com/ Software Link:...

VMWare vSphere Web Client 6.0 Cross Site Scripting

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/VMWARE-VSPHERE-FLASH-XSS.txt + ISR: apparitionsec Vendor: =============== www.vmware.com Product: ==================================== VMWare vSphere Web Client v5.1 - 6.0 A...

Web2py 2.14.5 - Multiple Vulnerabilities

Web2py 2.14.5 - Multiple Vulnerabilities Title - Web2py 2.14.5 Multiple Vulnerabilities LFI,XSS,CSRF Exploit Title : Web2py 2.14.5 Multiple Vulnerabilities LFI, XSS,CSRF Reported Date : 2-April-2016 Fixed Date : 4-April-2016 Exploit Author : Narendra Bhati -...

WAP Music CMS 1.0.2 SQL Injection

========================================================== + Title :- WAP MUSIC CMS - SQL INJECTION + Date :- 24 - MAR - 2016 + Vendor Homepage :- www.wapforum.org + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks :-...

SM Soft Tech CMS 1.0 SQL Injection

========================================================== + Title :- SM SOFT TECH CMS - SQL INJECTION + Date :- 24 - MAR - 2016 + Vendor Homepage :- http://www.smsofttech.net/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google Dorks :...

New Relic: Reflected XSS on Signup Page

Hello Team, I have found a reflected XSS on Signup Page i.e. on https://newrelic.com/signup. Please find the below details. Vulnerable URL: https://newrelic.com/signup Vulnerable Field: Your Email Address Vulnerable Parameter: email Parameter Type: POST Payload used: Browser used: Mozilla Firefox...

WordPress Newsletter Pro 2.5.3.3 Open Redirect

^^^^^^^^^^^ ^ Exploit Title : Wordpress Newsletter Pro Plugin Open Redirect ^ Exploit Author : Ashiyane Digital Security Team ^ Vendor Homepage: http://www.thenewsletterplugin.com/downloads ^ Google Dork : inurl:newsletter-pro/do.php ^ Date : 06 Feb. 2016 ^ Tested On : Win 10 | CyberFox Browser &...

File Manager PRO v1.3 iOS - Multiple Web Vulnerabilities

Document Title: =============== File Manager PRO v1.3 iOS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1704 Release Date: ============= 2016-02-03 Vulnerability Laboratory ID VL-ID: ====================================...

WordPress Tubepress 2 Cross Site Scripting

^^^^^^^^^^^ ^ Exploit Title : Wordpress Tubepress Plugin v 2 Cross Site Scripting ^ Exploit Author : Ashiyane Digital Security Team ^ Vendor Homepage : https://wordpress.org/plugins/tubepress/ ^ Date: 13 Jan 2016 ^ Tested On : Win 10 | CyberFox Browser & Kali Linux | IceWeasel ^ ^^^^^^^^^^^ ^...

PHP Melody CMS 2.3 SQL Injection

================================================================================ PHP Melody CMS v2.3 SQL injection ================================================================================ Vendor Homepage: https://www.phpsugar.com Date: 26/12/2015 Script Link:...

WordPress Twitter 2.37 Cross Site Scripting

Effected Version : 2.36 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : In the following fields put the payload as below...

ThaiWebPlus CMS Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : ThaiWebPlus CMS Cross Site Scripting Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://thaiwebplus.com Google Dork : Powered by ThaiWebPlus inurl:idrun= Date : 2015/12/12 Version : 1.0 1-1:Admin Page msg...

HumHub 0.11.2 and 0.20.0-beta.2 - SQL 注入漏洞

寻找SQL注入的一般步骤： 1、寻找数据输入（表单） 2、注入数据 3、检测异常响应，像HTTP的500错误，SQL报错 该过程可以借助多种工具实现自动化。 用AWVS检测出 /index.php 可能存在SQL注入。 以下地址会报SQL错误，from 字段是注入点: http://localhost/index.php?from=1'"&limit=10&mode=activity&r=space/space/stream&sguid=e9659cfc-886f-4524-94ae-1721999ad43b...

Monsta FTP 1.6.2 Cross Site Request Forgery / Cross Site Scripting

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-MONSTAFTP-0911.txt Vendor: ================================ www.monstaftp.com Product: ================================ monstaftpv1.6.2 Monsta FTP is open source PHP/Ajax cloudware...