XSSER - From XSS to RCE

From XSS to RCE 2.5 - Black Hat Europe Arsenal 2016 Demo Version 2.0 - 2015: https://www.youtube.com/playlist?list=PLIjb28IYMQgqqqApoGRCZO40vP-eKsgf Version 2.5 - 2016: https://www.youtube.com/playlist?list=PLRic6PgcrsWGkgacL6WFnSQKVRZIoofRj Requirements Python 2.7., version 2.7.11 was used for...

All In One WP Security & Firewall <= 4.1.2 - Multiple vulnerabilities in login CAPTCHA

The All In One WP Security & Firewall WordPress plugin was affected by a Multiple vulnerabilities in login CAPTCHA security vulnerability...

WordPress Plugin Acunetix WP Security Plugin 3.0.3 - Cross-Site Scripting

WordPress Plugin Acunetix WP Security Plugin 3.0.3 - Cross-Site Scripting 1. Introduction Exploit Title: Acunetix WP Security 3.0.3 XSS Date: May.03.2016 Exploit Author: Johto Robbie Facebook: https://www.facebook.com/johto.robbie Vendor: VN Hacker News Tested On: Apache 2.4.17 / PHP 5.6.16 /...

WordPress Plugin Acunetix WP Security Plugin 3.0.3 - Cross-Site Scripting

Introduction Exploit Title: Acunetix WP Security 3.0.3 XSS Date: May.03.2016 Exploit Author: Johto Robbie Facebook: https://www.facebook.com/johto.robbie Vendor: VN Hacker News Tested On: Apache 2.4.17 / PHP 5.6.16 / Windows 10 / WordPress 4.5.1 Category: Webapps Software Link:...

All In One WP Security And Firewall < 4.0.7 - Multiple SQL Injections

The All In One WP Security & Firewall WordPress plugin was affected by a Multiple SQL Injections security vulnerability...

All In One WP Security And Firewall < 4.0.6 - XSS

The All In One WP Security & Firewall WordPress plugin was affected by a XSS security vulnerability...

Wordpress Better-wp-security Plugin Remote Code Execution Vulnerability

Exploit for php platform in category web applications +++++++++++++++++++++ | + Exploit Title: Wordpress Better-wp-security Plugin Remote Code Execution | + Exploit Author: Tonel Team | + Vendor Homepage : https://wordpress.org/plugins/better-wp-security/ | + Download Link :...

WordPress Better WP Security Plugin <= 3.4.3 - Multiple XSS

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

WordPress Better WP Security Plugin <= 3.5.5 - Stored XSS

This plugin is prone to inc/admin/content.php idspecialfile parameter stored cross site scripting vulnerability. Solution Update the plugin...

WordPress Plugin All In One WP Security & Firewall admin/wp-security-list-404.php SQL Injection Vulnerability

WordPress is a set of blogging platform developed in PHP language by WordPress Software Foundation, which supports setting up personal blog sites on servers with PHP and MySQL.All In One WP Security & Firewall Plugin for WordPress is a Wordpress Security Plugin. All In One WP Security & Firewall...

WordPress All In One WP Security And Firewall 3.9.0 SQL Injection

Exploit Title : WordPress All In One WP Security & Firewall 3.9.0 SQL Injection Vulnerability Exploit Author : Claudio Viviani Vendor Homepage : https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/ Software Link :...

CVE-2015-0895

Cross-site request forgery CSRF vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 aka Not Found HTTP status codes...

CVE-2015-0894

SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 aka Not Found HTTP status codes...

CVE-2015-0895

All In One WP Security & Firewall for WordPress (versions before 3.9.0) is affected by a CSRF vulnerability that can allow an attacker, while a logged-in admin exists, to hijack the administrator’s authentication to delete 404 logs via forged requests. Root cause is CSRF in the plugin; impact inc...

CVE-2015-0895

Cross-site request forgery CSRF vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 aka Not Found HTTP status codes...

CVE-2015-0894

CVE-2015-0894 affects the WordPress plugin All In One WP Security & Firewall and its versions prior to 3.8.8. The vulnerability is described as a SQL injection (CWE-89) that could allow a remote attacker to execute arbitrary SQL commands via unspecified vectors, potentially impacting data confide...

PT-2015-4950

Name of the Vulnerable Software and Affected Versions All In One WP Security & Firewall plugin versions prior to 3.8.8 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For All In One WP Security & Firewall plugin versions prior to 3.8.8, update to...

PT-2015-4951

Name of the Vulnerable Software and Affected Versions All In One WP Security & Firewall plugin versions prior to 3.9.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 HTTP status codes...