Remote code execution

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CVE-2018-10083

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...

CVE-2018-10086

CMS Made Simple (CMSMS) up to version 2.2.7 has an arbitrary code execution vulnerability in the admin dashboard. The root cause is the use of eval('function testfunction'.rand()) which can bypass certain restrictions on these testfunction functions. Affected product: CMSMS. The issue is document...

CVE-2018-10086

CMS Made Simple CMSMS through 2.2.7 contains an arbitrary code execution vulnerability in the admin dashboard because the implementation uses "eval'function testfunction'.rand" and it is possible to bypass certain restrictions on these "testfunction" functions...

CMS Made Simple Arbitrary Code Execution Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism , etc. admin dashboard is one of the administration panel . An...

CMS Made Simple Arbitrary File Deletion Vulnerability

CMS Made Simple CMSMS is an open source content management system CMS developed by CMSMS team. The system supports role-based permission management system , wizard-based installation and update mechanism , intelligent caching mechanism , etc. admin dashboard is one of the administration panel . A...

CVE-2017-17736

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard...

PT-2018-6559

Name of the Vulnerable Software and Affected Versions: Kentico versions 9.0 through 9.0.50 Kentico versions 10.0 through 10.0.47 Description: The issue allows remote attackers to obtain Global Administrator access. This can be achieved by visiting the "CMSInstall/install.aspx" endpoint and then...

Deconf: Unauthenticated Reflected XSS in admin dashboard

The researcher has identified a Reflected XSS vulnerability within an analytics report of our plugin. The report was well documented, providing a step-by-step PoC to demonstrate the vulnerability...

Cross-site Scripting (XSS) Via Admin Dashboard

keystone is vulnerable to cross-site scripting XSS attacks. The user's input to the name field in the admin dashboard is not HTML escaped because the input is passed to JSON.stringify instead of doing proper serialization...

Bezaat Script V2 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title : Bezaat Script V2 SQL Injection Vulnerability Exploit Author : xBADGIRL21 Dork : Powed by Greenit Egypt for Information Technology Vendor Homepage : http://greenitegypt.net/products.php?catid=1 Tested on: BACKBOX MyBlog :...

Bezaat Script 2 SQL Injection

Exploit Title : Bezaat Script V2 SQL Injection Vulnerability Exploit Author : xBADGIRL21 Dork : Powed by Greenit Egypt for Information Technology Vendor Homepage : http://greenitegypt.net/products.php?catid=1 Tested on: BACKBOX MyBlog : http://xbadgirl21.blogspot.com/ skype:xbadgirl21 Date:...

Arabseed XCMS 1.0.9 SQL Injection

Exploit Title : Arabseed XCMS V1.0.9 SQL injection Vulnerability Exploit Author : xBADGIRL21 Vendor Homepage : http://arabseed.com/ Tested on: BACKBOX MyBlog : http://xbadgirl21.blogspot.com/ skype:xbadgirl21 Date: 07/09/2016 video Proof : https://youtu.be/ABNSN3XecHw a DESCRIPTION : + Arabseed i...

Cisco Identity Services Engine Admin Dashboard Page Cross-Site Scripting Vulnerability

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A cross-site scripting...

dashboard.admin.ucla.edu XSS vulnerability

Vulnerable URL: http://dashboard.admin.ucla.edu/portalbody.cfm?msg=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Yoast Google Analytics Stored Cross Site Scripting

OVERVIEW ========== Google Analytics by Yoast is a WordPress plug-in for monitoring website traffic. With approximately seven million downloads it’s one of the most popular WordPress plug-ins. A security vulnerability in the plug-in allows an unauthenticated attacker to store arbitrary HTML,...

b2evolution 4.0.3 Persistent XSS Vulnerability

No description provided by source. Source: http://packetstormsecurity.org/files/view/99362/b2evolution403-xss.txt ------------------------------------------------------------------------ Software................b2evolution 4.0.3 Vulnerability...........Persistent Cross-site Scripting Threat...

Relevanssi 2.7.2 Wordpress Plugin Stored XSS Vulnerability

No description provided by source. Exploit Title: Relevanssi User Searches WordPress plugin Stored XSS Date: 20-2-2011 Author: Saif El-Sherei Software Link: http://downloads.wordpress.org/plugin/relevanssi.2.7.2.zip Version: Relevanssi 2.7.2, WordPress 3.0.5 Tested on: FireFox 3.6.13, IE 8 Vendor...

Concrete CMS 5.4.1.1 - XSS/Remote Code Execution Exploit

No description provided by source. !/usr/bin/python Concrete CMS v5.4.1.1 xss/remote code execution exploit Download: http://www.concrete5.org/ Special Zeitgeist pre release - Moving Forward - 15th Jan 2011 They must find it difficult, those who take authority as the truth instead of truth as the...

WordPress Usernoise Plugin 3.7.8 - Persistent XSS

Usernoise plugin is prone to a persistent XSS vulnerability, because the user input is not being properly handled when a feedback is submitted. The affected area is the Wordpress admin dashboard. The vulnerability accepts arbitrary codes, including JavaScript. And all JavaScript code is executed...