php

Free Blog 1.0 – Multiple Vulnerabilities

# Free Blog 1.0 Multiple Vulnerability

WebsiteBaker Addon Concert Calendar 2.1.4 – Multiple Vulnerabilities

Advisory: Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi vulnerability

WordPress Plugin NextGEN Gallery – ‘test-head’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/57200/info

Joomla! Component com_incapsula – Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/57190/info

MotoCMS – ‘admin/data/users.xml’ Access Restriction / Information Disclosure

source: https://www.securityfocus.com/bid/57055/info

WordPress Plugin Google Document Embedder – Arbitrary File Disclosure (Metasploit)

##

E Sms Script – Multiple SQL Injections

# E SMS Script Multiple SQL Injection Vulnerability

Havalite CMS – ‘comment’ HTML Injection

source: https://www.securityfocus.com/bid/57169/info

pfSense 2.0.1 – Cross-Site Scripting / Cross-Site Request Forgery / Remote Command Execution

######################################################################

TomatoCart – ‘json.php’ Security Bypass

source: https://www.securityfocus.com/bid/57156/info

Multiple WordPress WPScientist Themes – Arbitrary File Upload

source: https://www.securityfocus.com/bid/57152/info

MyBB Profile Wii Friend Code – Multiple Vulnerabilities

# Exploit Title: MyBB Profile Wii Friend Code SQLi/Persistent XSS

WordPress Plugin Uploader – Arbitrary File Upload

source: https://www.securityfocus.com/bid/57112/info

WordPress Plugin Advanced Custom Fields – Remote File Inclusion (Metasploit)

##

osTicket – ‘tickets.php?status’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/57111/info

osTicket – ‘l.php?url’ Arbitrary Site Redirect

source: https://www.securityfocus.com/bid/57111/info

WordPress Plugin Xerte Online – ‘save.php’ Arbitrary File Upload

source: https://www.securityfocus.com/bid/57098/info

Astium VoIP PBX 2.1 build 25399 – Multiple Vulnerabilities/Remote Command Execution

#!/usr/bin/python

e107 1.0.2 – SQL Injection (via Cross-Site Request Forgery)

# Exploit Title: e107 v1.0.2 Administrator CSRF Resulting in SQL Injection

e107 1.0.1 – Arbitrary JavaScript Execution (via Cross-Site Request Forgery)

# Exploit Title: e107 v1.0.1 Administrator CSRF Resulting in Arbitrary Javascript Execution

WordPress Plugin Shopping Cart for WordPress – ‘/wp-content/plugins/levelfourstorefront/scripts/administration/exportaccounts.php?reqID’ SQL Injection

source: https://www.securityfocus.com/bid/57101/info

WordPress Plugin Shopping Cart for WordPress – ‘/wp-content/plugins/levelfourstorefront/scripts/administration/backup.php?reqID’ SQL Injection

source: https://www.securityfocus.com/bid/57101/info

WordPress Plugin Shopping Cart for WordPress – ‘/wp-content/plugins/levelfourstorefront/scripts/administration/exportsubscribers.php? reqID’ SQL Injection

source: https://www.securityfocus.com/bid/57101/info

WHMCS 5.0 – Insecure Cookie Authentication Bypass

source: https://www.securityfocus.com/bid/57145/info

Joomla! Component Spider Calendar – ‘date’ Blind SQL Injection

Happy New year for all

MyBB 1.6.9 – ‘editpost.php?posthash’ Blind SQL Injection

MyBB

WordPress Plugin Zingiri Forums – ‘language’ Local File Inclusion

source: https://www.securityfocus.com/bid/56777/info

WHM – ‘filtername’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/57061/info

cPanel – ‘detailbw.html’ Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/57060/info

cPanel WebHost Manager (WHM) – ‘/webmail/x3/mail/clientconf.html?acct’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/57060/info

cPanel – ‘dir’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/57064/info

Guru Auction 2.0 – Multiple SQL Injections

) ) ) ( ( ( ( ( ) )

WordPress Plugin Asset-Manager – Arbitrary ‘.PHP’ File Upload (Metasploit)

##

WordPress Plugin WP-Property – Arbitrary ‘.PHP’ File Upload (Metasploit)

##

cPanel – ‘account’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/57045/info

Hero Framework – users/login ‘Username’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/57035/info

Hero Framework – ‘search?q’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/57035/info

MyBB AwayList Plugin – ‘index.php?id’ SQL Injection

# Exploit Title: AwayList MyBB plugin SQLi 0day

MyBB HM My Country Flags – SQL Injection

# Exploit title: HM My Country Flags SQL Injection

City Directory Review and Rating Script – ‘search.php’ SQL Injection

# Exploit Title: City Directory Review and Rating Script SQL Injection

City Reviewer – ‘search.php’ Script SQL Injection

source: https://www.securityfocus.com/bid/57049/info

VoipNow Service Provider Edition – Arbitrary Command Execution

source: https://www.securityfocus.com/bid/57032/info

Elite Bulletin Board 2.1.21 – Multiple SQL Injections

Advisory ID: HTB23133

banana dance b.2.6 – Multiple Vulnerabilities

Advisory ID: HTB23118

Joomla! Component com_bit – ‘Controller’ Local File Inclusion

source: https://www.securityfocus.com/bid/56995/info

Joomla! Component com_ztautolink – ‘Controller’ Local File Inclusion

source: https://www.securityfocus.com/bid/56994/info

WordPress Theme Clockstone (and other CMSMasters Themes) – Arbitrary File Upload

# Exploit Title: [Clockstone and Various other CMSMasters Theme File Upload Vulnerabilities]

MyBB Transactions Plugin – ‘transaction’ SQL Injection

source: https://www.securityfocus.com/bid/57009/info

WordPress Plugin RokBox Plugin – ‘/wp-content/plugins/wp_rokbox/jwplayer/jwplayer.swf?abouttext’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/56953/info

PHPWCMS 1.5.4.6 – ‘preg_replace’ Multiple Vulnerabilities