WordPress Single Personal Message 1.0.3 SQL Injection

Exploit Title: Single Personal Message 1.0.3 a Plugin WordPress a Sql Injection Date: 28/11/2016 Exploit Author: Lenon Leite Vendor Homepage: https://wordpress.org/plugins/simple-personal-message/ Software Link: https://wordpress.org/plugins/simple-personal-message/ Contact:...

The React application in the most common XSS exploits and Defense-vulnerability warning-the black bar safety net

The author has been firmly React technology stack of the user, and therefore will pay attention to the React application security related topics. The author in my ownReact+Redux+Webpack2scaffolding the third level also uses a lot of server-side rendering/isomorphism straight out of the technology...

Acunetix v11 - Web Application Security Testing Tool

London, UK – November 2016 – Acunetix, the pioneer in automated web application security software, has announced the release of version 11. New integrated vulnerability management features extend the enterprise’s ability to comprehensively manage, prioritise and control vulnerability threats –...

Informatica: [marketplace.informatica.com] Persistent XSS through document title

Document titles are not properly escaped before being printed on https://marketplace.informatica.com/docs/ . By including a payload in a document title, an attacker can create a document with a persistent XSS vector which executes for anyone viewing the document page. Proof of concept === The...

CNDSOFT 2.3 - Cross-Site Request Forgery Arbitrary File Upload

CNDSOFT 2.3 - Cross-Site Request Forgery Arbitrary File Upload ========================================================================================================= Exploit Title: CNDSOFT 2.3 - Arbitrary File Upload with CSRF shell.php Author: Besim Google Dork: - Date: 19/10/2016 Type: webap...

yawast - The YAWAST Antecedent Web Application Security Toolkit

YAWAST is an application meant to simplify initial analysis and information gathering for penetration testers and security auditors. It performs basic checks in these categories: TLS/SSL - Versions and cipher suites supported; common issues. Information Disclosure - Checks for common information...

Colorful Blog Cross Site Scripting

Exploit Title : ----------- : Colorful Blog - Stored Cross Site Scripting Author : ----------------- : Besim Google Dork : --------- : - Date : -------------------- : 13/10/2016 Type : -------------------- : webapps Platform : --------------- : PHP Vendor Homepage :-- : - Software link : --------...

Colorful Blog - Cross-Site Request Forgery (Change Admin Password)

Exploit Title :----------- : Colorful Blog - Cross-Site Request Forgery Change Admin Pass Author :------------------ : Besim Google Dork :---------- : - Date :--------------------- : 13/10/2016 Type :--------------------- : webapps Platform :---------------- : PHP Vendor Homepage :-- : - Software...

Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)

Exploit Title : Maian Weblog 4.0 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : - Date : 10/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.maianweblog.com Software link : http://www.hotscripts.com/listings/jump/download/21864 CSRF PoC " /...

New Google Tools Help Devs Improve Content Security Policy Protection

Cross-site scripting is the cockroach of web application security vulnerabilities, enjoying continued longevity despite the abundant availability of scanning tools and programming advice designed to squash it. Google yesterday took another shot at eradicating XSS attacks with the release of two...

Microix Timesheet Module SQL Injection

Exploit Title: Microix timesheet module SQL Injection Google Dork: "Copyright by Microix" inurl:"/microixcloud/" Date: 2016-09-06 Software Link: http://www.microix.net/workflow-modules/timesheet-module/ Exploit Author: Anthony Cole Contact: http://twitter.com/acole76 Website:...

Open Redirect DDoS Tool: UFONet

Open Redirect DDoS Tool UFONet – is a tool designed to launch DDoS attacks against a target, using ‘Open Redirect’ vectors on third party web applications, like botnet. UFONet abuses OSI Layer 7-HTTP to create/manage ‘zombies’ and to conduct different attacks using; GET/POST, multithreading,...

Intercepting Proxy for Performing Web Application Security Testing: The Pappy Proxy

Intercepting Proxy for Performing Web application security testing The Pappy P roxy A ttack P roxy P rox Y Proxy is an intercepting proxy for performing web application security testing. Its features are often similar, or straight up rippoffs from Burp Suite . However, Burp Suite is neither open...

CVE-2016-3193

Fortinet CVE-2016-3193 is an XSS flaw in the FortiManager/FortiAnalyzer appliance web-application. Affected: FortiManager 5.x (before 5.0.12, before 5.2.6, before 5.4.1) and FortiAnalyzer 5.x (before 5.0.13, before 5.2.6, before 5.4.1). Root cause: unobstructed insertion of script/HTML by remote ...

GitLab - 'impersonate' Feature Privilege Escalation

Exploit for ruby platform in category web applications Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi...

GitLab - 'impersonate' Feature Privilege Escalation

Exploit Title: GitLab privilege escalation via "impersonate" feature Date: 02-05-2016 Software Link: https://about.gitlab.com/ Version: 8.2.0 - 8.2.4, 8.3.0 - 8.3.8, 8.4.0 - 8.4.9, 8.5.0 - 8.5.11, 8.6.0 - 8.6.7, 8.7.0 Exploit Author: Kaimi Website: https://kaimi.ru CVE: CVE-2016-4340 Category:...

bahasa.cs.ui.ac.id XSS vulnerability

Vulnerable URL: http://bahasa.cs.ui.ac.id/kbbi/kbbi.php?keyword=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

Apache Struts2 Remote Code Execution Vulnerability (CNVD-2016-04040)

Apache Struts is an open source framework for creating enterprise Java Web applications. A remote code execution vulnerability exists in Struts2, which can be exploited by an attacker to remotely execute arbitrary code by calling a malicious expression using a REST plugin...

XssPy - Web Application XSS Scanner

XssPy is a python tool for finding Cross Site Scripting vulnerabilities in websites. This tool is the first of its kind. Instead of just checking one page as most of the tools do, this tool traverses the website and find all the links and subdomains first. After that, it starts scanning each and...

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting Exploit Title: phpMyFAQ 2.9.0 Stored XSS Date: 09-06-2016 Software Link: http://www.phpmyfaq.de/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description PHP...