Mao10CMS v3.0.2 储存型xss

简要描述： rt 详细说明： 过滤不严。 以官网为例。 社区发布新话题 成功加载了js 地址 http://www.mao10.com/post-1772.html 然后用户的cookie就来了。。。 漏洞证明：...

Path traversal

The Joomlaskin JS Multi Hotel aka JS MultiHotel and Js-Multi-Hotel plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to 1 functions.php, 2 myCalendar.php, 3 refreshDate.php, 4 showimage.php, 5 widget.php, 6 phpthumb/GdThumb.inc.php, or 7...

CVE-2014-100009

Affected software: WordPress plugin JS Multi Hotel (aka JS MultiHotel, Js-Multi-Hotel), version 2.2.1 and earlier. Vulnerability: path disclosure via direct requests to multiple PHP files (functions.php, myCalendar.php, refreshDate.php, show_image.php, widget.php, phpthumb/GdThumb.inc.php, phpthu...

PT-2015-3613

Name of the Vulnerable Software and Affected Versions Joomlaskin JS Multi Hotel plugin versions 2.2.1 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the path parameter ...

CVE-2014-100008: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in includes/deleteimg.php in the Joomlaskin JS Multi Hotel aka JS MultiHotel and Js-Multi-Hotel plugin 2.2.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the path parameter...

PT-2015-3614

Name of the Vulnerable Software and Affected Versions Joomlaskin JS Multi Hotel plugin versions 2.2.1 and earlier Description The issue allows remote attackers to obtain the installation path via a request to several API endpoints, including "functions.php", "myCalendar.php", "refreshDate.php",...

PT-2015-3650

Name of the Vulnerable Software and Affected Versions Maian Uploader version 4.0 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities that allow remote attackers to hijack the authentication of unspecified users. This can lead to requests that conduct cross-site...

CVE-2014-100009: Exposure of Sensitive Information to an Unauthorized Actor

The Joomlaskin JS Multi Hotel aka JS MultiHotel and Js-Multi-Hotel plugin 2.2.1 and earlier for WordPress allows remote attackers to obtain the installation path via a request to 1 functions.php, 2 myCalendar.php, 3 refreshDate.php, 4 showimage.php, 5 widget.php, 6 phpthumb/GdThumb.inc.php, or 7...

53KF某插件存储XSS跨站（华夏名网\59互联\7k7k等大量网站中枪）

简要描述： 很牛逼很牛逼真的很牛逼，不信，你看 详细说明： 53客服 某插件在网页右下角有个企业收藏夹 点开里面有个分组。 而这个分组到底是干什么的，怎么分配的。我现在也没弄清楚 但是它的分组名称是可修改的。 修改名称，插入代码 test" 但是，审查元素去看代码。发现没有，失败了？ 可是实际上我们已经收到cookie了。 挂了一晚上加一个上午，收获颇丰啊O∩∩O哈！ 而且进去以后发现中枪的可不是一个域名。 7k7k，华夏名网，59互联，兄弟连+一大堆小站，6千加的cookie，怎么也有几百个网站吧。 img...

CVE-2013-7419

CVE-2013-7419 refers to a reflected XSS in the WordPress plugin Joomlaskin JS Multi Hotel (JS Multi Hotel) 2.2.1. The vulnerability is triggered in includes/refreshDate.php via the roomid parameter, allowing arbitrary web script/HTML injection in the user’s browser. The available documents identi...

PT-2015-3580

Name of the Vulnerable Software and Affected Versions Joomlaskin JS Multi Hotel plugin version 2.2.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the roomid parameter in the...

CVE-2013-7419: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in includes/refreshDate.php in the Joomlaskin JS Multi Hotel aka JS MultiHotel and Js-Multi-Hotel plugin 2.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the roomid parameter...

CVE-2014-9507

MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting XSS attacks by setting the content model for a revision to JS...

CVE-2014-9507: Improper Neutralization of Input During Web Page Generation

MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting XSS attacks by setting the content model for a revision to JS...

CVE-2011-3592

Multiple cross-site scripting XSS vulnerabilities in the PMAunInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a 1 database name, 2 table name, or 3 column name that is not properly handled after an...

CVE-2011-3591

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to 1...

CVE-2011-3591

CVE-2011-3591 describes multiple XSS vulnerabilities in phpMyAdmin 3.4.x before 3.4.5. An authenticated user can inject arbitrary script/HTML via a crafted row that triggers an improperly constructed confirmation message after inline editing and save operations, related to the files js/functions....

CVE-2011-3591

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to 1...

CVE-2011-3591

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations, related to 1...

PT-2014-2150

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.4.x through 3.4.4 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save...