Cross-Site Scripting (XSS)

Mortbay Jetty test web-app is vulnerable to cross-site scripting. The Dump Servlet does not output-sanitise before displaying on a user's browser. This allows a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of...

Facturation System 1.0 - 'modid' SQL Injection

Exploit Title: Facturation System 1.0 - 'modid' SQL Injection Dork: N/A Date: 2018-11-08 Exploit Author: Ihsan Sencan Vendor Homepage: http://obedalvarado.pw/simple-invoice/ Software Link: https://kent.dl.sourceforge.net/project/simple-invoice/simple-invoice-master.zip Version: 1.0 Category:...

Netscape Enterprise 3.63 Cross Site Scripting

alert"XSS" The server response: Request URL: http://X.X.X.X/servlet/SnoopServlet Request information: Request method: GET Request URI: /servlet/SnoopServlet Request protocol: HTTP/1.1 Servlet path: /servlet/SnoopServlet Path info: Path translated:...

GPS Tracking System 2.12 - username SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: GPS Tracking System 2.12 - 'username' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://sourceforge.net/projects/gpstracking/ Software Link: https://kent.dl.sourceforge.net/project/gpstracking/gps.zip Version:...

Facturation System 1.0 - modid SQL Injection

Facturation System 1.0 - modid SQL Injection Exploit Title: Facturation System 1.0 - 'modid' SQL Injection Dork: N/A Date: 2018-11-08 Exploit Author: Ihsan Sencan Vendor Homepage: http://obedalvarado.pw/simple-invoice/ Software Link:...

Netscape Enterprise 3.63 Cross Site Scripting Vulnerability

Exploit for multiple platform in category web applications alert"XSS" The server response: Request URL: http://X.X.X.X/servlet/SnoopServlet Request information: Request method: GET Request URI: /servlet/SnoopServlet Request protocol: HTTP/1.1 Servlet path: /servlet/SnoopServlet Path info: Path...

Cross-Site Scripting (XSS)

Jackrabbit Web Application is susceptible to cross-site scripting XSS attack. The attack exists because it does not escape the q parameter to 1 search.jsp or 2 swr.jsp...

Hanno's projects: Text injection at https://media.hboeck.de

Text injection possible at https://media.hboeck.de if we craft url like this: https://media.hboeck.de/?c=http://www.example.com We can see the output on web app. Impact Defacement of website by following crafted link...

Unspecified Vulnerability in Green Electronics RainMachine Mini-8 and Touch HD 12 Web Applications

Green Electronics RainMachine Mini-8 and Touch HD 12 Web Application are both products of Green Electronics USA.Green Electronics RainMachine Mini-8 is a smart irrigation sprinkler. Green Electronics RainMachine Mini-8 is a smart irrigation sprinkler and Touch HD 12 Web Application is a web-based...

Green Electronics RainMachine Mini-8 and Touch HD 12 Web Application Cross-Site Scripting Vulnerability

Green Electronics RainMachine Mini-8 and Touch HD 12 Web Application are both products of Green Electronics USA.Green Electronics RainMachine Mini-8 is a smart irrigation sprinkler. Green Electronics RainMachine Mini-8 is a smart irrigation sprinkler and Touch HD 12 Web Application is a web-based...

workandtravel.org.ua XSS vulnerability

Open Bug Bounty ID: OBB-695031 Description| Value ---|--- Affected Website:| workandtravel.org.ua Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

Mongo Web Admin 6.0 Information Disclosure

Exploit Title: Mongo Web Admin 6.0 - Information Disclosure Dork: N/A Date: 2018-11-04 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.mongoadmin.org/ Software Link: https://netix.dl.sourceforge.net/project/mongo-web-admin/mongoDesktopAdminSetup-beta-6.exe Version: 6.0 Category: Webapps...

SQL Injection Vulnerability in UsualToolCMS a_a***.php File

UsualToolCMS is an enterprise-level web content management system written in PHP+MYSQL that uses template separation technology to support the creation of multiple types of sites. A SQL injection vulnerability exists in the UsualToolCMS aa.php file. An attacker can exploit the vulnerability to...

PHP Proxy 3.0.3 - Local File Inclusion Exploit

Exploit for php platform in category web applications Exploit Title: PHP-Proxy 3.0.3 - Local File Inclusion Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.php-proxy.com/ Software Link: https://github.com/Athlon1600/php-proxy-app Version:...

PHP Proxy 3.0.3 - Local File Inclusion

PHP Proxy 3.0.3 - Local File Inclusion Exploit Title: PHP-Proxy 3.0.3 - Local File Inclusion Date: 04.11.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.php-proxy.com/ Software Link: https://github.com/Athlon1600/php-proxy-app Version:...

Poppy Web Interface Generator 0.8 - Arbitrary File Upload

Poppy Web Interface Generator 0.8 - Arbitrary File Upload Exploit Title: Poppy Web Interface Generator 0.8 - Arbitrary File Upload Dork: N/A Date: 2018-11-04 Exploit Author: Ihsan Sencan Vendor Homepage: http://poppy.dc-development.de/ Software Link:...

AngularJS < 1.6.1 Cross-Site Scripting

According to its self-reported version number, AngularJS is prior to 1.6.1. Therefore, it may be affected by a JSONP callback vulnerability than can lead to Cross-Site Scripting XSS. Note that the scanner has not tested for these issues but has instead relied only on the application's self-report...

Voovi Social Networking Script 1.0 - user SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Voovi Social Networking Script 1.0 - 'user' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: http://www.adminspoint.com/voovi/index.php Software Link:...

WordPress 4.4.x < 4.4.11 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A flaw in $wpdb-prepare can create unsafe queries leading to potential SQL injection flaws with plugins and themes. - Multiple cross-site scripting XSS vulnerabilities...

Royal TSX - Information Disclosure

Royal TSX - Information Disclosure RoyalTS/X Exploit var wsUri = "ws://127.0.0.1:54890/"; var output; function init output = document.getElementById"output"; testWebSocket; function testWebSocket writeToScreen"Let's retrieve some data..."; websocket = new WebSocketwsUri; websocket.onopen =...