Reality < 2.4.0 - Multiple Persistent XSS

----- Persistent XSS on any property page: ----- Vulnerable input fields: 1 - Description & Price - 'PRICE POSTFIX TEXT' and 'SECOND PRICE POSTFIX TEXT'; 2 - Additional Information - 'TITLE' and 'VALUE'; 3 - Location & Map - 'ADDRESS '. Payload Sample: ----- Persistent XSS on user profile page:...

Inventory Webapp - 'itemquery' SQL injection

Exploit Title: Inventory Webapp SQL injection Data: 05.09.2019 Exploit Author: mohammad zaheri Vendor HomagePage: https://github.com/edlangley/inventory-webapp Tested on: Windows Google Dork: N/A ========= Vulnerable Page: ========= /php/add-item.php ========== Vulnerable Source: ========== Line3...

Palo Alto Software: Clickjacking

Summary Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of the...

Exploit for Improper Input Validation in Jenkins

hackUtils It is a hack tool kit for pentest and web security research, which is based on BeautifulSoup bs4 module http://www.crummy.com/software/BeautifulSoup/bs4/. Usage: hackUtils.py options Options: -h, --help Show basic help message and exit -b keyword, --baidu=keyword Fetch URLs from Baidu...

XSS Vulnerability in the Mobile Mall of Henan NetZhong.com Computer Science and Technology Co.

Henan net in the net computer technology limited company is a micro letter public platform application and development of science and technology-based technology company. There is an XSS vulnerability in the mobile mall of Henan NetZhong.com Computer Science and Technology Co. Ltd, which can be...

Alkacon OpenCMS 10.5.x - Local File inclusion Vulnerability

Exploit for multiple platform in category web applications Exploit Title: Alkacon OpenCMS 10.5.x - Multiple LFI in Alkacon OpenCms Site Management Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: 10.5.x Tested on: 10.5.5...

Alkacon OpenCMS 10.5.x - Local File inclusion

Exploit Title: Alkacon OpenCMS 10.5.x - Multiple LFI in Alkacon OpenCms Site Management Google Dork: N/A Date: 18/07/2019 Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: 10.5.x Tested on: 10.5.5 / 10.5.4 CVE :...

Weak Password Vulnerability in Tianqing Web Application Security Gateway

SkyQuest Web Application Security Gateway is a new generation of Web security protection and application delivery application security product developed by Qisda, which is used to defend against attacks targeting Web application vulnerabilities, analyze HTTP/HTTPS traffic on Web servers and...

WordPress wp-members plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-members is a website membership plugin used in it. Cross-site request forgery vulnerability exists in WordPress wp-member plugin...

CVE-2019-10383

CVE-2019-10383 is a stored XSS in Jenkins up to 2.191 (LTS up to 2.176.2) where an attacker with Overall/Administer permissions can abuse the update center URL to inject HTML/JavaScript in update center pages. Affected component is Jenkins update center handling; root cause is insufficient escapi...

WordPress posts-in-page plugin path traversal vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. posts-in-page is a plugin for embedding posts in pages. A path traversal vulnerability exists in the WordPress posts-in-page plugin. T...

CVE-2019-15533

XENFCoreSharp (pre-2019-07-16) is affected by CVE-2019-15533: it allows SQL injection in web/verify.php. The connected documents confirm the vulnerable component and input point but do not provide exploit specifics, affected version ranges beyond the date, or remediation details in the supplied s...

WordPress custom-sidebars plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. custom-sidebars is a custom feature list plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

CVE-2019-13599

CVE-2019-13599 affects CentOS Web Panel (CWP) 0.9.8.848, where the login process can be used to determine if a username is valid by comparing response times, creating a user-enumeration timing side-channel. The vulnerability is documented across multiple sources (NVD, Red Hat, CNVD, PRION, etc.) ...

WordPress peters-login-redirect plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. peters-login-redirect is a redirection plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

Kimai 2 - Persistent Cross-Site Scripting

Exploit Title: Kimai 2- persistent cross-site scripting XSS Date: 07/15/2019 Exploit Author: osamaalaa Vendor Homepage: link Software Link: https://github.com/kevinpapst/kimai2 Fixed on Github : https://github.com/kevinpapst/kimai2/pull/962 Version: 2 1-Normal user will try to add timesheet from...

CVE-2019-15062

An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer...

CVE-2019-3635

Exfiltration of Data in McAfee Web Gateway MWG 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe...

Microsoft Windows Graphics Component CVE-2019-1149 Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. Successful exploits may allow an attacker to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Office 2019...

SEC Investigating Data Leak at First American Financial Corp.

The U.S. Securities and Exchange Commission SEC is investigating a security failure on the Web site of real estate title insurance giant First American Financial Corp. that exposed more than 885 million personal and financial records tied to mortgage deals going back to 2003, KrebsOnSecurity has...