14405 matches found
Paid Member Subscriptions < 2.4.2 - Authenticated SQL Injection
The plugin did not sanitise, validate or escape its order and orderby parameters before using them in SQL statement, leading to Authenticated SQL Injections in the Members and Payments pages. http://www.example.com/wp-admin/admin.php?page=pms-members-page&orderby=userid&order=asc,select from...
Chrome casts away the padlock—is it good riddance or farewell?
It’s been an interesting journey for security messaging where browsers are concerned. Back in the day, many of the websites you’d visit on a daily basis weren’t secure. By secure, I mean that they didnt use HTTPS. There was no padlock, which meant that the traffic between you and the website wasn...
In0ri - Defacement Detection With Deep Learning
In0ri is a defacement detection system utilizing a image-classification convolutional neural network. Introduction When monitoring a website, In0ri will periodically take a screenshot of the website then put it through a preprocessor that will resize the image down to 250x250px and numericalize t...
Algolia: Information disclosure -> 2fa bypass -> POST exploitation
Greetings! So i was testing algolia.com. Impressed to find out that there are mitigations in place to prevent POST exploitation such as : When 2fa is enabled we need "old password" to update following things : - To update the password - To disable the 2fa, etc might more more.... And we need 2fa...
The vulnerability of the Sulu content management system, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.
The vulnerability of the Sulu content management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
U.S. Dept Of Defense: XSS on https://████████/████' parameter
PoC https://█████/██████████ ███████ Impact XSS on https://████/ System Hosts ███ Affected Products and Versions CVE Numbers Steps to Reproduce Got to https://██████/███ Suggested Mitigation/Remediation Actions...
Responsive Tourism Website 3.1 Remote Code Execution
Exploit Title: Responsive Tourism Website 3.1 - Remote Code Execution RCE Unauthenticated Date: 22.06.2021 Exploit Author: Tagoletta Tağmaç Software Link: https://www.sourcecodester.com/php/14838/simple-responsive-tourism-website-using-php-free-source-code.html Version: V 3.1 Tested on: MacOS &...
All Vulnerabilities for escoladegovernodes.londrina.pr.gov.br Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Backup by 10Web <= 1.0.20 - Reflected Cross-Site Scripting (XSS)
The plugin does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue PoC http://example.com/wp-admin/admin.php?page=buwdrestore=general%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain;%20m0ze...
Command Execution Vulnerability in YXcms
YXcms is a PHP and MySQL based enterprise building content management system CMS. A command execution vulnerability exists in YXcms. An attacker can exploit this vulnerability to gain server privileges...
WoWonder Social Network Platform 3.1 - Authentication Bypass
Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass Date: 11.06.2021 Exploit Author: securityforeveryone.com Researchers : Security For Everyone Team - https://securityforeveryone.com Vendor Homepage: https://www.wowonder.com/ Software Link:...
How to perform a website security check- 6 tools to check website security
By Owais Sultan Running a small business or a large corporation? Your website needs security amid increasing cyberattacks. Here are some website security check tools. This is a post from HackRead.com Read the original post: How to perform a website security check- 6 tools to check website securit...
Stock in & out <= 1.0.4 - Authenticated SQL Injection
The plugin lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection attacks. Users with a role of contributor or higher can exploit this vulnerability...
Infographic: How Are Bad Bots Hurting Your Business?
Bad bots are software applications which run automated tasks with malicious intent over the internet. They scrape data from sites without permission in order to reuse it and gain a competitive edge e.g. pricing, inventory levels, proprietary content, etc.. They are used for scalping, the act of...
All Vulnerabilities for courses.oum.edu.ws Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
MurMurHash - Tool To Calculate A MurmurHash Value Of A Favicon To Hunt Phishing Websites On The Shodan Platform
This little tool is to calculate a MurmurHash value of a favicon to hunt phishing websites on the Shodan platform. What is MurMurHash? MurmurHash is a non-cryptographic hash function suitable for general hash-based lookup. The name comes from two basic operations, multiply MU and rotate R, used i...
UPchieve: Session Hijacking leads to full control of account by attacker
Hi Team , I am Samprit Das MCEH Metaxone Certified Ethical Hacker and a Security Researcher I just checked your website and got a critical vulnerability please read the report carefully. Description:- The Session Hijacking attack consists of the exploitation of the web session control mechanism,...
entrerios.gov.ar Cross Site Scripting vulnerability OBB-2016175
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| entrerios.gov.ar ---|--- Open Bug Bount...
Topcoder: Reflected XSS in https://www.topcoder.com/blog/category/community-stories/
Summary: Reflected XSS in https://www.topcoder.com/blog/category/community-stories/ Note: This is a reflected XSS vulnerability in a hidden input. With that vulnerability, an attacker could write his own code on the website. But with this vulnerability, an attacker also could lead a user, to go o...
A simple guide to keeping customers safe on your website
By Waqas For advice on how to implement proper security measures, below is a guide for keeping customers safe while they’re on your website. This is a post from HackRead.com Read the original post: A simple guide to keeping customers safe on your website...