Jeedom <=4.0.38 - Cross-Site Scripting Detection

Jeedom through 4.0.38 contains a cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Jeedom through 4.""" from kittysploit import from...

MicroStrategy Library <11.1.3 - Cross-Site Scripting Detection

MicroStrategy Library before 11.1.3 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Aryanic HighMail (High CMS) - Cross-Site Scripting Detection

A cross-site scripting vulnerability in Aryanic HighMail High CMS versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in Aryanic HighMail High CMS versio...

WordPress Car Seller - Auto Classifieds Script - SQL Injection Detection

The requestlistrequest AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitize, validate or escape the orderid POST parameter before using it in a SQL statement, leading to a SQL injection...

GeoServer <1.2.2 - Remote Code Execution Detection

Programs run on GeoServer before 1.2.2 which use jt-jiffle and allow Jiffle script to be provided via network request are susceptible to remote code execution. The Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects downstream GeoServer 1.1.22...

GZ Forum Script 1.8 - Cross-Site Scripting Detection

Cross-site scripting XSS is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. Attackers often initiate an XSS attack by sending a malicious link to a user and enticing the user to click it. !/usr/bin/env python3 -- coding: utf-8...

STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion Detection

STAGIL Navigation for Jira Menu & Themes plugin before 2.0.52 is susceptible to local file inclusion via modifying the fileName parameter to the snjCustomDesignConfig endpoint. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This...

Trilium <0.52.4 - Cross-Site Scripting Detection

Trilium prior to 0.52.4, 0.53.1-beta contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Trilium prior to 0.""" from...

WordPress Events Calendar <1.4.5 - Cross-Site Scripting Detection

WordPress Events Calendar plugin before 1.4.5 contains multiple cross-site scripting vulnerabilities. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

PHPJabbers Food Delivery Script - SQL Injection Detection

PHPJabbers Food Delivery Script 3.0 has a SQL injection SQLi vulnerability in the "q" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Food Delivery Script 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting Detection

There is a Cross Site Scripting XSS vulnerability in the "action" parameter of index.php in PHPJabbers Yacht Listing Script v1.0. !/usr/bin/env python3 -- coding: utf-8 -- """There is a Cross Site Scripting XSS vulnerability in the "action" parameter of index.""" from kittysploit import from...

PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting Detection

PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting XSS via the "action" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Fundraising Script v1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHPJabbers Service Booking Script 1.0 - Cross Site Scripting Detection

A vulnerability was found in PHP Jabbers Service Booking Script 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be initiated remotely. !/usr/bin/env pytho...

PHPJabbers Food Delivery Script v3.0 - SQL Injection Detection

PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Food Delivery Script v3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

Ricoh Web Image Monitor - Reflected XSS Detection

A reflected cross-site scripting vulnerability exists in the laser printers and MFPs multifunction printers which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor. !/usr/bin/env python3 -- coding:...

Nordex NC2 - Cross-Site Scripting Detection

Nordex NC2 contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks...

BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure Detection

Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files. !/usr/bin/env python3 -- coding: utf-8 ...

Cute Editor for ASP.NET 6.4 - Cross-Site Scripting Detection

Cute Editor for ASP.NET 6.4 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks...

MaxSite CMS > V106 - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page." !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/...