Advanced Comment System 1.0 - SQL Injection

Exploit Title: SQL injection in Advanced comment system v1.0 Date: 29-10-2018 Exploit Author: Rafael Pedrero Vendor Homepage: http://www.plohni.com Software Link: http://www.plohni.com/wb/content/php/download/Advancedcommentsystem1-0.zip,...

HTTP Request Smuggling

Apache Tomcat is vulnerable to HTTP request smuggling. Incorrect handling of HTTP requests allows a remote attacker to poison the web cache, bypass web application firewall protections or perform XSS attacks. The vulnerability is exploited by submitting crafted values for the Transfer-Encoding an...

Gumbo CMS 0.99 - SQL Injection

Exploit Title: Gumbo CMS 0.99 - SQL Injection Dork: N/A Date: 2018-11-11 Exploit Author: Ihsan Sencan Vendor Homepage: http://gumbo-cms.net/ Software Link: https://netix.dl.sourceforge.net/project/gumbo-cms/0.99%20beta/gumbo-0.99beta.zip Version: 0.99 Category: Webapps Tested on:...

Easyndexer 1.0 - Arbitrary File Download

Exploit Title: Easyndexer 1.0 - Arbitrary File Download Dork: N/A Date: 2018-11-10 Exploit Author: Ihsan Sencan Vendor Homepage: https://sourceforge.net/projects/easyndexer/ Software Link: https://ayera.dl.sourceforge.net/project/easyndexer/easyndexerwin32.exe Version: 1.0 Category: Webapps Teste...

Alive Parish 2.0.4 - SQL Injection / Arbitrary File Upload

Exploit Title: Alive Parish 2.0.4 - SQL Injection / Arbitrary File Upload Dork: N/A Date: 2018-11-11 Exploit Author: Ihsan Sencan Vendor Homepage: https://demo.aliveparish.com Software Link: https://netcologne.dl.sourceforge.net/project/aliveparish/aliveparish-v2.0.zip Version: 2.0.4 Category:...

Cross-Site Scripting (XSS)

Mortbay Jetty test web-app is vulnerable to cross-site scripting. The Dump Servlet does not output-sanitise before displaying on a user's browser. This allows a remote attacker to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of...

Facturation System 1.0 - 'modid' SQL Injection

Exploit Title: Facturation System 1.0 - 'modid' SQL Injection Dork: N/A Date: 2018-11-08 Exploit Author: Ihsan Sencan Vendor Homepage: http://obedalvarado.pw/simple-invoice/ Software Link: https://kent.dl.sourceforge.net/project/simple-invoice/simple-invoice-master.zip Version: 1.0 Category:...

Netscape Enterprise 3.63 Cross Site Scripting

alert"XSS" The server response: Request URL: http://X.X.X.X/servlet/SnoopServlet Request information: Request method: GET Request URI: /servlet/SnoopServlet Request protocol: HTTP/1.1 Servlet path: /servlet/SnoopServlet Path info: Path translated:...

GPS Tracking System 2.12 - username SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: GPS Tracking System 2.12 - 'username' SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://sourceforge.net/projects/gpstracking/ Software Link: https://kent.dl.sourceforge.net/project/gpstracking/gps.zip Version:...

Facturation System 1.0 - modid SQL Injection

Facturation System 1.0 - modid SQL Injection Exploit Title: Facturation System 1.0 - 'modid' SQL Injection Dork: N/A Date: 2018-11-08 Exploit Author: Ihsan Sencan Vendor Homepage: http://obedalvarado.pw/simple-invoice/ Software Link:...

Netscape Enterprise 3.63 Cross Site Scripting Vulnerability

Exploit for multiple platform in category web applications alert"XSS" The server response: Request URL: http://X.X.X.X/servlet/SnoopServlet Request information: Request method: GET Request URI: /servlet/SnoopServlet Request protocol: HTTP/1.1 Servlet path: /servlet/SnoopServlet Path info: Path...

Cross-Site Scripting (XSS)

Jackrabbit Web Application is susceptible to cross-site scripting XSS attack. The attack exists because it does not escape the q parameter to 1 search.jsp or 2 swr.jsp...

Hanno's projects: Text injection at https://media.hboeck.de

Text injection possible at https://media.hboeck.de if we craft url like this: https://media.hboeck.de/?c=http://www.example.com We can see the output on web app. Impact Defacement of website by following crafted link...

Green Electronics RainMachine Mini-8 and Touch HD 12 Web Application Cross-Site Scripting Vulnerability

Green Electronics RainMachine Mini-8 and Touch HD 12 Web Application are both products of Green Electronics USA.Green Electronics RainMachine Mini-8 is a smart irrigation sprinkler. Green Electronics RainMachine Mini-8 is a smart irrigation sprinkler and Touch HD 12 Web Application is a web-based...

Unspecified Vulnerability in Green Electronics RainMachine Mini-8 and Touch HD 12 Web Applications

Green Electronics RainMachine Mini-8 and Touch HD 12 Web Application are both products of Green Electronics USA.Green Electronics RainMachine Mini-8 is a smart irrigation sprinkler. Green Electronics RainMachine Mini-8 is a smart irrigation sprinkler and Touch HD 12 Web Application is a web-based...

workandtravel.org.ua XSS vulnerability

Open Bug Bounty ID: OBB-695031 Description| Value ---|--- Affected Website:| workandtravel.org.ua Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

SQL Injection Vulnerability in UsualToolCMS a_a***.php File

UsualToolCMS is an enterprise-level web content management system written in PHP+MYSQL that uses template separation technology to support the creation of multiple types of sites. A SQL injection vulnerability exists in the UsualToolCMS aa.php file. An attacker can exploit the vulnerability to...

Mongo Web Admin 6.0 Information Disclosure

Exploit Title: Mongo Web Admin 6.0 - Information Disclosure Dork: N/A Date: 2018-11-04 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.mongoadmin.org/ Software Link: https://netix.dl.sourceforge.net/project/mongo-web-admin/mongoDesktopAdminSetup-beta-6.exe Version: 6.0 Category: Webapps...

PHP Proxy 3.0.3 - Local File Inclusion Exploit

Exploit for php platform in category web applications Exploit Title: PHP-Proxy 3.0.3 - Local File Inclusion Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.php-proxy.com/ Software Link: https://github.com/Athlon1600/php-proxy-app Version:...

PHP Proxy 3.0.3 - Local File Inclusion

PHP Proxy 3.0.3 - Local File Inclusion Exploit Title: PHP-Proxy 3.0.3 - Local File Inclusion Date: 04.11.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Contact: https://pentest.com.tr Vendor Homepage: https://www.php-proxy.com/ Software Link: https://github.com/Athlon1600/php-proxy-app Version:...