webapps

BlogPHP 2.0 – Persistent Cross-Site Scripting

# Exploit Title: BlogPHP v2 - XSS

XpressEngine 1.4.5.7 – Persistent Cross-Site Scripting

# Exploit Title: XpressEngine version 1.4.5.7 Persistent XSS Vulnerability

BlueSoft Rate My Photo Site – ‘ty’ SQL Injection

source: https://www.securityfocus.com/bid/49092/info

BlueSoft Banner Exchange – ‘referer_id’ SQL Injection

source: https://www.securityfocus.com/bid/49091/info

Search Network 2.0 – ‘query’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/49064/info

Simple Machines Forum (SMF) 2.0 – Session Hijacking

Simple Machines forum (SMF) 2.0 session hijacking

Cart Software – Multiple Vulnerabilities

=========================================================

ATutor 2.0.2 – Multiple Vulnerabilities

ATutor 2.0.2 Multiple Remote Vulnerabilities (SQLi/XSS/PD)

AChecker 1.2 – Multiple Error-Based SQL Injection Vulnerabilities

AChecker 1.2 Multiple Error-Based SQL Injection vulnerabilities

acontent 1.1 – Multiple Vulnerabilities

AContent 1.1 Multiple SQL Injection Vulnerabilities

WordPress Plugin Media Library Categories 1.0.6 – SQL Injection

# Exploit Title: Media Library Categories

WordPress Plugin UPM Polls 1.0.3 – SQL Injection

# Exploit Title: UPM Polls get_row("SELECT * FROM `".$wpdb->prefix."pppm_polls` WHERE `id` = $QID", ARRAY_A);

WordPress Plugin Social Slider 5.6.5 – SQL Injection

# Exploit Title: Social Slider

WordPress Plugin ProPlayer 4.7.7 – SQL Injection

# Exploit Title: ProPlayer plugin

Sun/Oracle GlassFish Server – (Authenticated) Code Execution (Metasploit)

##

WordPress Plugin E-Commerce 3.8.4 – SQL Injection

# Exploit Title: WP E-commerce plugin

Softbiz Recipes Portal Script – Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/49051/info

Community Server 2007/2008 – ‘TagSelector.aspx’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/49022/info

WordPress Plugin WP E-Commerce 3.8.6 – ‘cart_messages[]’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/49009/info

DZYGroup CMS Portal – Multiple SQL Injections

.__.__ .__ __

Joomla! Component com_jdirectory – SQL Injection

=====================================================================

WordPress Plugin TimThumb 1.32 – Remote Code Execution

# Exploit Title: WordPress TimThumb Plugin - Remote Code Execution

HESK 2.2 – Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/49008/info

Joomla! Component com_community – ‘userid’ SQL Injection

source: https://www.securityfocus.com/bid/48983/info

Joomla! Component com_xeslidegalfx – ‘id’ SQL Injection

source: https://www.securityfocus.com/bid/48981/info

Ataccan E-Ticaret Scripti – ‘id’ SQL Injection

source: https://www.securityfocus.com/bid/48970/info

BESNI OKUL PORTAL – ‘sayfa.asp’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/48969/info

mt LinkDatenbank – ‘b’ Cross-Site Scripting

source: https://www.securityfocus.com/bid/48967/info

MyBB MyTabs Plugin – ‘tab’ SQL Injection

source: https://www.securityfocus.com/bid/48952/info

SiteGenius – Blind SQL Injection

=====================================================

MyBB MyTabs Plugin – SQL Injection

=====================================================================

CA Arcserve D2D GWT RPC – Credential Information Disclosure (Metasploit)

##

ZoneMinder 1.24.3 – Remote File Inclusion

# Exploit Title: Zoneminder 1.24.3 Remote File Inclusion Vulnerability

CMSPro! 2.08 – Cross-Site Request Forgery

CMSPro! 2.08 CSRF Vulnerability

Curverider Elgg 1.7.9 – Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/48946/info

Joomla! Component obSuggest – Local File Inclusion

) ) ) ( ( ( ( ( ) )

Digital Scribe 1.5 – register_form()’ Multiple POST Cross-Site Scripting Vulnerabilities

Digital Scribe 1.5 (register_form()) Multiple POST XSS Vulnerabilities

Link Station Pro – Multiple Vulnerabilities

%+

ManageEngine ServiceDesk Plus 8.0 Build 8013 – Multiple Cross-Site Scripting Vulnerabilities

=======================================================================

cFTP 0.1 – ‘r80’ Arbitrary File Upload

Chyrp 2.x swfupload Extension – ‘upload_handler.php’ Arbitrary File Upload / Arbitrary PHP Code Execution

source: https://www.securityfocus.com/bid/48672/info

Chyrp 2.x – ‘/includes/lib/gz.php?File’ Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/48672/info

Chyrp 2.x – ‘action’ Traversal Local File Inclusion

source: https://www.securityfocus.com/bid/48672/info

Sitecore CMS 6.4.1 – ‘url’ Open Redirection

source: https://www.securityfocus.com/bid/48930/info

HP Network Automation 9.10 – SQL Injection

source: https://www.securityfocus.com/bid/48924/info

Joomla! Component com_virtuemart 1.1.7/1.5 – Blind SQL Injection (Metasploit)

# Exploit Title: Joomla 1.5 com_virtuemart %q{

SWAT Samba Web Administration Tool – Cross-Site Request Forgery

Thanks & Regards,

PHPJunkYard GBook 1.6/1.7 – Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/48905/info

MBoard 1.3 – ‘url’ Open Redirection

source: https://www.securityfocus.com/bid/48902/info

Support Incident Tracker (SiT!) 3.63 p1 – ‘tasks.php?selected[]’ SQL Injection

source: https://www.securityfocus.com/bid/48896/info