wityCMS 0.6.1 - Cross-Site Scripting

Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field Date: 05/28/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: https://creatiwity.net/witycms Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.1 Version: 0.6.1 Tested on:...

CVE-2018-10136

iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...

Cross site scripting

NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php...

CVE-2018-5687

NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php...

Deconf: Reflected XSS in admin settings

The researcher and our team determined that actually there wasn't any applicable vulnerability...

PHP Scripts Mall Single Theater Booking Cross-Site Request Forgery Vulnerability

PHP Scripts Mall Single Theater Booking is an open source theater script. A cross-site request forgery vulnerability exists in PHP Scripts Mall Single Theater Booking. A remote attacker can use the admin/sitesettings.php file to change sensitive settings on the user panel, or even inject web scri...

CVE-2017-17930

PHP Scripts Mall Professional Service Script has CSRF via admin/generalsettingupd.php, as demonstrated by modifying a setting in the user panel...

CVE-2017-1002012

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/adminsetting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement...

VACRON VIG-US731VE 1.0.18-09-B727 IP Camera - Authentication Bypass

VACRON VIG-US731VE 1.0.18-09-B727 IP Camera - Authentication Bypass Exploit Title: IP Camera VACRON VIG-US731VE Date: 2017-07-18 Exploit Author: anonymous Vendor Homepage: www.vacron.com Version: V1.0.18-09-B727 1. doesn't require credentials to fetch snapshot like this:...

BigTree-CMS 4.2.x < 4.2.17 Multiple Vulnerabilities

Binary data 700143.prm...

Sql injection

Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack...

CVE-2017-7360

Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack...

CVE-2017-6918

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Navigation Social can be changed...

Cross site request forgery (csrf)

CSRF exists in BigTree CMS 4.1.18 with the nav-social parameter to the admin/settings/update/ page. The Navigation Social can be changed...

CVE-2017-6915

CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. The Colophon can be changed...

CVE-2017-6918

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Navigation Social can be changed...

CVE-2017-6917

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed...

CVE-2017-6917

CVE-2017-6917 affects BigTree CMS 4.2.16. The Red Hat and NVD entries confirm a CSRF in the admin/settings/update/ endpoint where the value parameter can alter the Colophon. The connected sources do not provide exploit details or a remediation; no patch/version changes are explicitly stated in th...

WordPress InPost Gallery plugin <= 2.1.2 - Authenticated Persistent Cross-Site (XSS) Vulnerability

WordPress InPost Gallery plugin version = 2.1.2 is vulnerable to Cross-Site XSS vulnerability. The values on the admin settings page are not escaped. Solution Update the plugin...

WordPress Admin Pack By Site Caseiro 1.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Title: WordPress 'Admin Pack by SITE CASEIRO' Plugin Version: 1.1 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-14 Download: - https://wordpress.org/plugins/admin-pack-by-site-caseiro/ -...