WordPress Tubepress 2 Cross Site Scripting

^^^^^^^^^^^ ^ Exploit Title : Wordpress Tubepress Plugin v 2 Cross Site Scripting ^ Exploit Author : Ashiyane Digital Security Team ^ Vendor Homepage : https://wordpress.org/plugins/tubepress/ ^ Date: 13 Jan 2016 ^ Tested On : Win 10 | CyberFox Browser & Kali Linux | IceWeasel ^ ^^^^^^^^^^^ ^...

PHP DateTime Use-After-Free

Use After Free Vulnerability in unserialize with DateTime CVE-2015-0273 Taoguang Chen - Write Date: 2015.1.29 - Release Date: 2015.2.20 A use-after-free vulnerability was discovered in unserialize with DateTime/DateTimeZone/DateInterval/DatePeriod objects's wakeup magic method that can be abused...

iPrimal Forums - '/admin/index.php' Remote File Inclusion

iPrimal Forums Remote File Inclusion Download:http://ipigroup.org/downloads/forums.zip Found by Bl0od3r Vulnerable Code: line 126-129 ..... if$GET'p' == '' echo 'Please select an item from the menu above.'; else include$GET'p'.'.php'; ..... Affected File: /admin/index.php = Vulnerability:...

PHP121 Instant Messenger 1.4 - Remote Code Execution

!/usr/bin/php -q -d shortopentag=on works with magicquotesgpc = Off\r\n\r\n"; echo "a dork: inurl:php121login.php | inurl:php121im.php | intitle:"PHP121 - PLEASE"\r\n\r\n"; if $argc4 echo "Usage: php ".$argv0." host path cmd OPTIONS\r\n"; echo "host: target server ip/hostname\r\n"; echo "path:...

IMP 2.x SQL injection vulnerabilities

IMP is a popular webmail package written in PHP. It ships with some UNIX systems and is also used on Windows servers. The version 2 of the program contains some SQL injection flaws which allow any remote user to access the webmail system's database. Valid user authentication is not required in...