EUVD-2018-17142

Malware in sbrugna...

CVE-2018-5370

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

CVE-2018-5370

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

Design/Logic Flaw

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

CVE-2018-5370

CVE-2018-5370 affects BizLogic xnami 1.0, a PHP-based image sharing script. The issue is a Cross-Site Scripting (XSS) vulnerability via the comment parameter in the addComment action to the /media/ajax URI. The root cause is insufficient input sanitization on the comment field, enabling injection...

PT-2018-16927

Name of the Vulnerable Software and Affected Versions BizLogic xnami version 1.0 Description The issue allows for XSS via the comment parameter in an addComment action to the "/media/ajax" API endpoint. Recommendations For BizLogic xnami version 1.0, avoid using the comment parameter in the...

CVE-2018-5370: Improper Neutralization of Input During Web Page Generation

BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...

Xnami Image Sharing 1.0 Cross Site Scripting

Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID: CVE-2018-5370 Xnami facilitates the...

PT-2017-13442

Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2.2 Description The issue allows for unrestricted file upload in the backend/media/ajax rename.php file via the extension parameter. This can be exploited by changing the file extension, for example, from .jpg to .php...

PT-2017-13002

Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2 Description The issue allows remote authenticated users to upload any file, including malicious ones, via the media upload function. This is demonstrated by uploading a ZIP archive containing a .php file through the...