Apache Struts2 Remote Code Execution Vulnerability (CNVD-2016-04040)

Apache Struts is an open source framework for creating enterprise Java Web applications. A remote code execution vulnerability exists in Struts2, which can be exploited by an attacker to remotely execute arbitrary code by calling a malicious expression using a REST plugin...

XssPy - Web Application XSS Scanner

XssPy is a python tool for finding Cross Site Scripting vulnerabilities in websites. This tool is the first of its kind. Instead of just checking one page as most of the tools do, this tool traverses the website and find all the links and subdomains first. After that, it starts scanning each and...

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting

phpMyFAQ 2.9.0 - Persistent Cross-Site Scripting Exploit Title: phpMyFAQ 2.9.0 Stored XSS Date: 09-06-2016 Software Link: http://www.phpmyfaq.de/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description PHP...

CVE-2016-4317: XSS on viewmyprofile.action page

The viewmyprofile.action resource was vulnerable to persistent XSS...

Trend Micro Direct Pass - Bypass & Cross Site Vulnerability

Document Title: =============== Trend Micro Direct Pass - Bypass & Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1716 Trend Micro Security ID: 1-1-1039900197 Release Date: ============= 2016-05-01 Vulnerability Laboratory ID...

Coursera: XSS in https://www.coursera.org/courses/

DESCRIPTION ================= It has been identified that the page located at https://www.coursera.org/courses/ is prone to cross-site scripting issues. Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts also commonly referred to...

shop.rostex.ua Open Redirect vulnerability

Vulnerable URL: http://shop.rostex.ua/setlang?lang=en=https://www.xssposed.org/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated Google Pagerank| 0...

How Often Should You Scan Websites and Web Applications for Vulnerabilities?

Web Applications and Websites Exist in a Dynamic Environment There is no questioning the fact that the web application security landscape is in a constant state of flux. The pace of change is not only rapid but resembles a constant game of cat and mouse between hackers and security professionals...

webapps.icma.org XSS vulnerability

Vulnerable URL: https://webapps.icma.org/pm/9402/public/cover.cfm?author=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 10:11 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

PHPMyLicense 3.0.0 - 3.1.4 - DoS Exploit

Exploit for php platform in category dos / poc Exploit Title: PHPMyLicense Stored Cross Site Scripting Date: 09-10-2015 Exploit Author: Aria Akhavan Rezayat @ Websec GesmbH Website: https://websec-test.com Vendor Homepage: https://phpmylicense.com Software Link:...

xpshop网店系统sql注入再来一处

简要描述： 应该还有几个就收工了，其实还有一些，不过感觉好累不想弄了。再挖多几个就收工了！ 详细说明： 漏洞位置xpshop.webui.IspOrderReturnBy： protected void PageLoadobject sender, EventArgs e base.Response.AddHeader"Pragma", "No-Cache"; base.Response.Buffer = true; base.Response.ExpiresAbsolute = DateTime.Now.AddSeconds-1.0; base.Response.Expires = 0...

VuFind 1.0 Cross Site Scripting

VuFind 1.0 Web Application Reflected XSS Cross-site Scripting 0-Day Bug Security Issue Exploit Title: VuFind Results? &lookfor parameter Reflected XSS Web Security Vulnerability Product: VuFind Vendor: VuFind Vulnerable Versions: 1.0 Tested Version: 1.0 Advisory Publication: September 20, 2015...

v5shop SQL commond.aspx SQL注入漏洞

简要描述 V5Shop网店系统是上海威博旗下一款B2C网上开店软件产品，适合中小型企业及个人快速构建个性化网上商店。该程序V5shop8.2存在通杀SQL注入漏洞且非常严重,可直接爆出管理员帐号密码,后台上传也可做任何过滤。 利用EXP: /commond.aspx?id=1 and 1=select top 1 name from webadmin 上面这个可以直接显示出管理员用户名 /commond.aspx?id=1 and 1=select top 1 pass from webadmin 上面这个可以显示MD5密码 默认后台地址： /weblogin/Login.aspx...

Burp Suite Professional 1.6.26 - The Leading Toolkit for Web Application Security Testing

Burp Suite is an integrated platform for performing security testing of web applications. Its various tools work seamlessly together to support the entire testing process, from initial mapping and analysis of an application's attack surface, through to finding and exploiting security...

Invision Power Board (IP.Board) 4.x - Persistent Cross-Site Scripting

Invision Power Board IP.Board 4.x - Persistent Cross-Site Scripting Exploit Title: IP.Board 4.X Stored XSS Date: 27-08-2015 Software Link: https://www.invisionpower.com/ Exploit Author: snop. Contact: http://twitter.com/rabbitzorg Website: http://rabbitz.org Category: webapps 1. Description A...

Invision Power Board (IP.Board) 4.x - Persistent Cross-Site Scripting

Exploit Title: IP.Board 4.X Stored XSS Date: 27-08-2015 Software Link: https://www.invisionpower.com/ Exploit Author: snop. Contact: http://twitter.com/rabbitzorg Website: http://rabbitz.org Category: webapps 1. Description A registered or non-registered user can create a calendar event including...

Google Analyticator 6.4.9.4 Cross Site Scripting

Information -------------------- Advisory by Netsparker. Name: Multiple XSS Vulnerabilities in Google Analyticator Affected Software : Google Analyticator WordPress Plugin Affected Versions: 6.4.9.4 and possibly below Vendor Homepage : https://wordpress.org/plugins/google-analyticator/...

AN IT CMS - SQL Injection Vulnerability

========================================================== + Title :- WAN IT CMS - SQL Injection Vulnerability + Date :- 23 - July - 2015 + Vendor Homepage :- http://www.wanitltd.com/ + Version :- All Versions + Tested on :- Nginx/1.4.5, PHP/5.2.17, Linux - Windows + Category :- webapps + Google...

PHPfileNavigator 2.3.3 - Cross-Site Request Forgery

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-PHPFILENAVIGATOR0812a.txt Vendor: ================================ pfn.sourceforge.net Product: =================================== PHPfileNavigator v2.3.3 pfn Is...

WordPress Plugin Video Gallery 2.7 - SQL Injection

WordPress Plugin Video Gallery 2.7 - SQL Injection Exploit Title: WordPress Video Gallery 2.7 SQL Injection Date: 20-01-2015 Software Link: https://wordpress.org/plugins/contus-video-gallery/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl...