AWBS v2.9.6 Multiple Remote Vulnerabilities

Summary Whether starting new or looking to expand your existing web hosting and/or domain registration business, the AWBS fully automated solutions and unique features will allow you achieve your goal with minimum effort and cost. Description AWBS suffers from multiple SQL Injection...

SkaDate Lite 2.0 Remote Code Execution Exploit

Summary SkaDate Lite is a new platform that makes it easy to start online dating business in just a few easy steps. No programming or design knowledge is required. Install the solution, pick a template, and start driving traffic to your new online dating site. Description SkaDate Lite suffers fro...

Zend Server 5.6.0 Multiple Remote Script Insertion Vulnerabilities

Summary Zend Server is a complete, enterprise-ready Web Application Server for running and managing PHP applications. Description Zend Server and its components suffers from a cross-site scripting vulnerability. The persistent stored XSS issues are triggered when input passed via several paramete...

iBrowser Plugin v1.4.1 (lang) Local File Inclusion Vulnerability

Summary iBrowser is an image browser plugin for WYSIWYG editors like tinyMCE, SPAW, htmlAREA, Xinha and FCKeditor developed by net4visions. It allows image browsing, resizing on upload, directory management and more with the integration of the phpThumb image library. Description iBrowser suffers...

Native Instruments Reaktor 5 Player v5.5.1 Heap Memory Corruption Vulnerability

Summary REAKTOR 5 PLAYER is your free entry point to the award-winning and avant-garde audio world of REAKTOR 5 - the super-powerful modular sound studio that made Native Instruments famous. Description The NI's Reaktor 5 Player suffers from multiple file handling vulnerability when processing .e...

Zen Cart v1.3.9f (typefilter) Local File Inclusion Vulnerability

Summary Zen Cart is an online store management system. It is PHP-based, using a MySQL database and HTML components. Support is provided for numerous languages and currencies, and it is freely available under the GNU GPL. Description Zen Cart v1.3.9f suffers from a file inlcusion vulnerability LFI...

Mp3 Tag Assistant Pro 2.92 (tag metadata) Remote Stack Overflow PoC

Summary MP3 Tag Assistant Professional 2.92 is a professional-level audio tag editor with UNICODE support. Description MP3 Tag Assistant Professional 2.92 is vulnerable to a stack buffer overflow attack when loading a malicious mp3 file or file that supports tags filled with overly long A's in it...

NUUO NVRmini 2 NE-4160 ShellShock Remote Code Execution

Summary NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS functionality. Setup is simple and easy, with automatic port forwarding settings built in. NVRmini 2 supports POS integration, making this the perfect solution for small retail chain stores. NVRmini 2 also comes full equipp...

OpenWGA Developer Studio 3.1.0 OpenDialog Arbitrary Code Execution

Summary The OpenWGA Developer Studio packages an OpenWGA CMS server together with all necessary development and deployment tools to create, develop, deploy, share and maintain your OpenWGA CMS applications. Description The application suffers from an arbitrary code execution vulnerability when...

RealtyScript v4.0.2 Multiple CSRF And Persistent XSS Vulnerabilities

Summary RealtyScript is award-winning real estate software that makes it effortless for a real estate agent, office, or entrepreneur to be up and running with a real estate web site in minutes. The software is in daily use on thousands of domain names in over 40 countries and has been translated...

MTP Poll 1.0 Multiple Remote Script Insertion Vulnerabilities

Summary More than poll is a polling system with a powerful administration tool. It features: multiple pools, templates, unlimited options, IP Logging, cookie support, and more. Description MTP Poll script suffers from multiple stored cross-site scripting vulnerabilities. The issues are triggered...

XAMPP 1.7.7 Multiple URI Based Cross-Site Scripting Vulnerabilities

Summary XAMPP is an easy to install Apache distribution containing MySQL, PHP and Perl. Description XAMPP suffers from multiple XSS issues in several scripts that use the 'PHPSELF' variable. The vulnerabilities can be triggered in the 'xamppsecurity.php', 'cds.php' and 'perlinfo.pl' because there...

AContent 1.1 Multiple SQL Injection Vulnerabilities

Summary AContent is an open source learning content authoring system and respository used to create interoperable, accessible, adaptive Web-based learning content. It can be used along with learning management systems to develop, share, and archive learning materials. Description Input passed via...

ZKTeco ZKBioSecurity 3.0 Multiple XSS Vulnerabilities

Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...

up.time 7.5.0 XSS And CSRF Add Admin Exploit

Summary The next-generation of IT monitoring software. Description The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-i...

Balero CMS v0.7.2 Multiple JS/HTML Injection Vulnerabilities

Summary Balero CMS is an open source project that can help you manage the page of your company with just a few guided steps, minimizing the costs that many companies make to have your advertising medium and/or portal. Description Input passed to the 'content' POST parameter and the cookie 'counte...

Privacyware Privatefirewall 7.0 Unquoted Service Path Privilege Escalation

Summary Privatefirewall multi-layered endpoint security software protects 32 and 64 bit Windows desktops and servers from malware and unauthorized use. Personal firewall, packet inspection, URL filtering, anti-logger, process monitor, and application/system behavior modeling and anomaly detection...

CorelDRAW X7 CDR File (CdrTxt.dll) Off-By-One Stack Corruption Vulnerability

Summary CorelDRAW is one of the image-creating programs in a suite of graphic arts software used by professional artists, educators, students, businesses and the general public. The CorelDRAW Graphics Suite X7, which includes CorelDRAW, is sold as stand-alone software and as a cloud-based...

Hero Framework 3.69 Remote Reflected Cross-Site Scripting Vulnerability

Summary Hero formerly Caribou CMS is a white label, open source PHP website content management system CMS and development platform. Description Hero suffers from a XSS vulnerability when parsing user input to the 'month' parameter via GET method. Attackers can exploit this weakness to execute...

Pointter PHP Content Management System 1.2 Multiple Vulnerabilities

Summary Pointter PHP Content Management System is an advanced, fast and user friendly CMS script that can be used to build simple websites or professional websites with product categorization, product blogs, member login and search modules. The webmaster can create unlimited static page boxes,...

EDraw Flowchart ActiveX Control 2.3 (EDImage.ocx) Remote DoS Exploit (IE)

Summary Do you want to learn how to draw? Now you can online! Learn how to draw like a local application with Edraw Flowchart ActiveX Control that lets you quickly build basic flowcharts, organizational charts, business charts, hr diagram, work flow, programming flowchart and network diagrams...

Zortam MP3 Player 1.50 (m3u) Integer Division by Zero Exploit

Summary Zortam Mp3 Player will enable you to listen all your favorite tracks and at the same time enjoy a show of lights and images visualizing the covers of your albums and song lyrics. Description Zortam Mp3 Player suffers from a division by zero attack when handling .m3u files, resulting in...

iScripts EasyCreate 3.0 Multiple Vulnerabilities

Summary iScripts EasyCreate is a private label online website builder. This software allows you to start an online business by offering website building services to your customers. Equipped with drag and drop design functionality, crisp templates and social sharing capabilities, this online websi...

dotCMS 3.2.4 Multiple Vulnerabilities

Summary DotCMS is the next generation of Content Management System CMS. Quick to deploy, open source, Java-based, open APIs, extensible and massively scalable, dotCMS can rapidly deliver personalized, engaging multi-channel sites, web apps, campaigns, one-pagers, intranets - all types of content...

LimeSurvey v2.00+ (build 131107) Script Insertion And SQL Injection Vulnerability

Summary LimeSurvey formerly PHPSurveyor is a free and open source on-line survey application written in PHP based on a MySQL, PostgreSQL or MSSQL database, distributed under the GNU General Public License. As a web server-based software it enables users to develop and publish on-line surveys, and...

FluxBB 1.5.3 Multiple Remote Vulnerabilities

Summary FluxBB is fast, light, user-friendly forum software for your website. Description FluxBB suffers from a cross-site scripting, cross-site request forgery and URL redirect vulnerability. The application allows users to perform certain actions via HTTP requests without performing any validit...

Subrion CMS 2.2.1 CSRF Add Admin Exploit

Summary Subrion is a free open source content management system. It's written in PHP 5 and utilizes MySQL database. Subrion CMS can be easily integrated into your current website or used as a stand alone platform. It's extremely flexible and scalable php system that stands for a content managemen...

vtiger CRM 5.2.1 Multiple Remote Cross-Site Scripting Vulnerabilities

Summary vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support. Description vtiger CRM suffers from a XSS vulnerability when parsing user input to the...

Ashampoo Burning Studio Elements 10.0.9 (.ashprj) Heap Overflow Vulnerability

Summary Ashampoo Burning Studio Elements offers you everything you need to burn movies, music and data - fast and effectively. The software with the intuitive user interface focuses on the core competencies of burning software and offers you compact functions to tackle all tasks relating to your...

LEADTOOLS ActiveX Common Dialogs 16.5 Multiple Remote Vulnerabilities

Summary With LEADTOOLS you can control any scanner, digital camera or capture card that has a TWAIN 32 and 64 bit device driver. High-level acquisition support is included for ease of use while low-level functionality is provided for flexibility and control in even the most demanding scanning...

Microsoft Visio 2010 v14.0.4514.1004 (dwmapi.dll) DLL Hijacking Exploit

Summary Microsoft Visio is a diagramming program for Microsoft Windows that uses vector graphics to create diagrams. Description MS Visio 2010 suffers from a dll hijacking vulnerability that enables the attacker to execute arbitrary code on a local level. The vulnerable extension is .vss thru...

InfraPower PPS-02-S Q213V1 Insecure Direct Object Reference Authorization Bypass

Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is ...

InfraPower PPS-02-S Q213V1 Multiple XSS Vulnerabilities

Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is ...

OpenMRS 2.3 (1.11.4) XML External Entity (XXE) Processing PoC Exploit

Summary OpenMRS is an application which enables design of a customized medical records system with no programming knowledge although medical and systems analysis knowledge is required. It is a common framework upon which medical informatics efforts in developing countries can be built. Descriptio...

OpenMRS 2.3 (1.11.4) Expression Language Injection Vulnerability

Summary OpenMRS is an application which enables design of a customized medical records system with no programming knowledge although medical and systems analysis knowledge is required. It is a common framework upon which medical informatics efforts in developing countries can be built. Descriptio...

iniNet SpiderControl SCADA Editor 6.30.01 Insecure File Permissions

Summary Modular and automated engineering is provided for HMI and SCADA. The tools are developed to join a large range of engineering modules together quickly. We modularize our software, as the mechanics of a system are modularized today. Easy to visualize with a few clicks. Description...

WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Creation Exploit (RCE)

Summary MiwoFTP is a smart, fast and lightweight file manager plugin that operates from the back-end of WordPress. Description MiwoFTP WP Plugin suffers from a cross-site request forgery remote code execution vulnerability. The application allows users to perform certain actions via HTTP requests...

Cart Engine 3.0.0 Remote Code Execution

Summary Open your own online shop today with Cart Engine! The small, yet powerful and don't forget, FREE shopping cart based on PHP & MySQL. Unique features of Cart Engine include: CMS engine based on our qEngine, product options, custom fields, digital products, search engine friendly URL, user...

Huawei Technologies eSpace Meeting Service 1.0.0.23 Local Privilege Escalation

Summary Huawei's eSpace Meeting solution fully meets the needs of enterprise customers for an integrated daily collaboration system by integrating the conference server, conference video terminal, conference user authorization, and teleconference. Description The application is vulnerable to an...

ImpressPages CMS v3.6 Remote Arbitrary File Deletion Vulnerability

Summary ImpressPages CMS is an open source web content management system with revolutionary drag & drop interface. Description Input passed to the 'files0file' parameter in '/ipcms/modules/administrator/repository/controller.php' is not properly sanitised before being used to delete files. This c...

Windu CMS 2.2 Multiple Persistent Cross-Site Scripting Vulnerabilities

Summary Windu CMS is a simple, lightweight and fun-to-use website content management software. Description Multiple stored XSS vulnerabilities exist when parsing user input to the 'name' and 'username' POST parameters. Attackers can exploit these weaknesses to execute arbitrary HTML and script co...

Wordpress Newsletter Plugin 3.2.6 (alert) Reflected XSS Vulnerability

Summary Newsletter is the perfect WordPress plugin for creating real newsletters and mail marketing system on your WordPress blog. Description The plugin suffers from a XSS issue due to a failure to properly sanitize user-supplied input to the 'alert' GET parameter in the 'page.php' script...

Anchor CMS v0.6 Multiple Persistent XSS Vulnerabilities

Summary Anchor is a content management system, written in PHP5, built for art-directed posts. Description Anchor CMS suffers from multiple stored and reflected XSS vulnerabilities when parsing user input to several parameters via GET and POST method. Attackers can exploit this weakness to execute...

AContent 1.1 (category_name) Remote Script Insertion Vulnerability

Summary AContent is an open source learning content authoring system and respository used to create interoperable, accessible, adaptive Web-based learning content. It can be used along with learning management systems to develop, share, and archive learning materials. Description AContent suffers...

PG eLMS Pro vDEC_2007_01 Multiple Blind SQL Injection Vulnerabilities

Summary eLMS Pro solution is an outstanding and yet simple Learning Management system. Our product is designed for any education formations: from small distance training companies up to big colleges and universities. The system allows to build courses, import SCORM content, deploy online learning...

MODx Revolution CMS 2.0.4-pl2 Remote XSS POST Injection Vulnerability

Summary MODx Revolution is a powerful PHP Content Management Framework that plays nicely with custom code and helps you build sites faster and maintain them with ease. With Revolution you'll leverage the best things to come around since MVC and Active Record. Description The MODx Revolution CMS...

InfraPower PPS-02-S Q213V1 Cross-Site Request Forgery

Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle IPD-02-S only to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is ...

up.time 7.5.0 Superadmin Privilege Escalation Exploit

Summary The next-generation of IT monitoring software. Description up.time suffers from a privilege escalation issue. Normal user can elevate his/her privileges by sending a POST request seting the parameter 'userroleid' to 1. Attacker can exploit this issue using also cross-site request forgery...

Kemana Directory 1.5.6 (qvc_init()) Cookie Poisoning CAPTCHA Bypass Exploit

Summary Experience the ultimate directory script solution with Kemana. Create your own Yahoo or Dmoz easily with Kemana. Unique Kemana's features including: CMS engine based on our qEngine, multiple directories support, user friendly administration control panel, easy to use custom fields,...

phlyLabs phlyMail Lite 4.03.04 Path Disclosure and Stored XSS Vulnerabilities

Summary phlyMail offers you an interface in the browser to have access to your emails, contacts, appointments, tasks, files and bookmakrs from anyhwere, where you have internet access. This can be your home, workplace, train station, abroad, offroad, in the woods or your own backyard. Description...