[WAppEx v2.0] Web Application Exploitation Tool

WAppEx is an integrated Web Application security assessment and exploitation platform designed with the whole spectrum of security professionals to web application hobbyists in mind. It suggests a security assessment model which revolves around an extensible exploit database. Further, it...

Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...

Joomla! Component com_collector - Arbitrary File Upload

Exploit Title:Joomla comcollecter shell upload Author: Red Dragonal Alb0zZ Team Home :HackForums.AL,alb0zz.in Date :19/01/2013 Category:: web apps Google dork: inurl:index.php?option=comcollector Tested on: Windows XP Download: http://www.steevo.fr/en/download Home Page: http://www.steevo.fr/...

XSS vulnerability in source tab configure project

Create a new group named "alert"XSS" 2. In the OnDemand administration section click Fisheye, then Configure to the right of the project name This vulnerability is due to an unescaped group.name parameter in projectrepositorypermissions.vm e.g...

BigDump 0.29b and 0.32b - Multiple Vulnerabilities

BigDump 0.29b and 0.32b - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/56744/info BigDump is prone to a cross-site scripting vulnerability, an SQL-injection vulnerability, and an arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data. Exploiting...

[CVE-2012-5777]EmpireCMS Template Parser Remote PHP Code Execution Vulnerability

Exploit Title : Answer my question wordpress plugin Multiple Cross-Site Scripting Vulnerabilities Author:Marcela Benetrix home:www.girlinthemiddle.net Date: 09/19/12 version: 1.1 software link:http://wordpress.org/extend/plugins/answer-my-question/ Answer my question plugin description This plugi...

[Burp Suite] Free Edition v1.5

Burp Suite helps you secure your web applications by finding the vulnerabilities they contain. Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking ...

Achievo 1.4.5 - Multiple Vulnerabilities (1)

Information -------------------- Name : XSS, LFI and SQL Injection Vulnerabilities in Achievo Software : Achievo 1.4.5 and possibly below. Vendor Homepage : http://www.achievo.org Vulnerability Type : Cross-Site Scripting, Local File Inclusion and SQL Injection Severity : Critical Researcher :...

World Health Organization website hacked by NullCrew

A well known hacking group "Nullcrew" once again most active hacking group right now. Dumping database from number of websites daily. Their latest target was World Health Organization WHO website. Well, World Health Organization website who.int need treatment now, because their admin panel...

CMSMini 0.2.2 Cross Site Scripting

Information -------------------- Name : XSS Vulnerabilities in CMSMini Software : CMSMini 0.2.2 and possibly below. Vendor Homepage : http://sourceforge.net/projects/cmsmini/ Vulnerability Type : Cross-Site Scripting Severity : Critical Researcher : Canberk Bolat Advisory Reference : NS-12-012...

How to Minimize Web Application Security Risk !

With Web applications remaining a popular target for attackers, Web app security sometimes seems like a digital version of the "Good, the Bad and the Ugly." Vulnerabilities in web applications are now the largest vector of enterprise security attacks. Web application security is much more...

CVE-2011-5203

CVE-2011-5203 concerns a SQL injection in Akiva WebBoard’s WB/Default.asp before version 8 SR 1, exploitable remotely via the name parameter. Affected component is WebBoard’s server-side script; underlying issue is improper input handling enabling arbitrary SQL execution. NVD reports a CVSS v2 ba...

CVE-2012-5298

CVE-2012-5298 concerns Mavili Guestbook (released November 2007). The vulnerability arises because guestbook.mdb is stored under the web root with insufficient access control, allowing remote attackers to read the database by direct request. The impact is exposure of guestbook data; exploitation ...

Diy21 CMS v3.10 (product.php) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Diy21 CMS v3.10 product.php SQL Injection Vulnerability Date: 03-10-2012 Author: Mouh Marvel-Dz Facebook : http://www.facebook.com/mouh.marvel Category: webapps Google dork: intext:"Powered by: Diy21 CMS v3.10"...

Post non-book information management system SQL injection-vulnerability warning-the black bar safety net

Injection point: http://target/asearch.do?status=showpage&LanguageType=1 Database: proone Table:ACCOUNT Fields:ACCID,is to the accname,PASSWORD,QQ,EMAIL,TELEPHONE, etc. !...

Cannonbolt Portfolio Manager 1.0 Cross Site Scripting / SQL Injection

Exploit for php platform in category web applications Cannonbolt Portfolio Manager v1.0 Stored XSS and SQL Injection Vulnerabilities Vendor: IWCn Systems Inc. Product web page: http://www.iwcn.ws Affected version: 1.0 Summary: Cannonbolt Portfolio Manager is a sleek and AJAX based PHP script to...

Joomla! Component Spider Calendar - SQL Injection

Joomla! Component Spider Calendar - SQL Injection Exploit Title: Joomla spider calendar lite Remote Exploit dork: inurl:comspidercalendar Date: 29-08-2012 Author: Daniel Barragan "D4NB4R" Twitter: @D4NB4R site: http://poisonsecurity.wordpress.com/ Vendor:...

myBloggie 2.1.6 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: myBloggie 2.1.6 CSRF Vulnerability Date: 17/8/2012 Author: LolzSec Software Link: http://mywebland.com/download.php?id=19 Category:: webapps Greetings to: DaOne , All LCA Members , email protected CSRF Add Admin 0day.today...

Nasa Cross Site Scripting

Exploit Title: Feedback form heasarc.gsfc.nasa.gov Cross Site Scripting Date: 13/08/2012 Author: Ryuzaki Lawlet Web/Blog: http://justryuz.blogspot.com/ Category: webapps Security:RISK: High Vendor or Software Link: Google dork: - Tested on: Linux Exploit/p0c :...

phpList 2.10.18 - unconfirmed Cross-Site Scripting

phpList 2.10.18 - unconfirmed Cross-Site Scripting source: https://www.securityfocus.com/bid/54887/info PHPList is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...