Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting

Exploit Title: Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting Exploit Author: Shivam Vermacyb3rn3rd Date: 2021-01-05 Vendor Homepage: https://code-projects.org/expense-tracker-in-php-with-source-code/ Software Link: https://code-projects.org Version: 1.0 Category: Web Applicatio...

Expense Tracker 1.0 Cross Site Scripting

Exploit Title: Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting Exploit Author: Shivam Vermacyb3rn3rd Date: 2021-01-05 Vendor Homepage: https://code-projects.org/expense-tracker-in-php-with-source-code/ Software Link: https://code-projects.org Version: 1.0 Category: Web Applicatio...

Click2Magic 1.1.5 - Stored Cross-Site Scripting

Exploit Title: Click2Magic 1.1.5 - Stored Cross-Site Scripting Exploit Author: Shivam Vermacyb3rn3rd Date: 2020-12-25 Google Dork: N/A Vendor Homepage: https://www.click2magic.com/user/agent/index Software Link: https://www.click2magic.com Version: 1.1.5 Category: Web Application Tested on: Kali...

Egavilanmedia User Registration & Login System Cross-Site Scripting Vulnerability (CNVD-2021-01547)

Egavilanmedia User Registration & Login System is a management platform for user registration and login from Egavilanmedia, USA. A cross-site scripting vulnerability exists in EGavilanMedia User Registration and Login System With Admin Panel version 1.0, which can be exploited by an attacker to...

WP Postratings < 1.86.1 - Authenticated Stored Cross-Site Scripting

The plugin does not sanitise the postratingsimage parameter from its options page wp-admin/admin.php?page=wp-postratings/postratings-options.php. Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfilteredhtml...

Media Library Assistant < 2.90 - Authenticated Blind SQL Injection

The Media Library Assistant WordPress plugin was affected by an authenticated admin+ blind SQL injection vulnerability when there is at least one Custom Field Rule set in the plugin's options. There need to be at least one Custom Field Rule in the plugin Custom Fields settings...

CVE-2020-16270

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of...

XSS Vulnerability in Situ CMS

Situ CMS is the short name of Situ Tourism Website Management System, which is a self-developed website management system applicable to the construction of tourism websites. An XSS vulnerability exists in SITO CMS, which can be exploited by attackers to obtain an administrator cookie...

Stored XSS Vulnerability in Jeesite Framework

JeeSite is an enterprise information technology development infrastructure platform , Java enterprise applications open source framework. Jeesite framework has a stored XSS vulnerability that can be exploited by an attacker to obtain administrator cookie information...

XSS vulnerability in Extreme CMS (CNVD-2020-38476)

Extreme CMS is an enterprise-level open source content building system. Extreme CMS has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as administrator cookies...

Storage-based cross-site scripting vulnerability exists in the background of enterprise website building system of Zibo Shining Network Technology Co.

Zibo Shining Network Technology Co., Ltd. enterprise station-building system a specialized enterprise station-building solutions for the product. There is a stored cross-site scripting vulnerability in the background of Zibo Shining Network Technology Co. Attackers can use the vulnerability to...

XSS Vulnerability in Xi'an Deyatong Technology Co.

Based on multi-layer cloud computing architecture, DEYATOM CMS makes full use of big data, cloud computing, artificial intelligence and other technologies to build a government website intensification platform with a unified standard system, a unified technology platform, a unified security...

XSS Vulnerability in UQCMS Cloud Business-B2B2C System

UQCMS Cloud Business-B2B2C System Multi-merchant e-commerce system is a B2B2C e-commerce software. UQCMS Cloud Merchant-B2B2C System suffers from an XSS vulnerability that can be exploited by attackers to obtain administrator cookie information...

115CMS suffers from XSS vulnerability

115CMS is a content management system developed with ThinkPHP framework. 115CMS suffers from an XSS vulnerability that can be exploited by attackers to execute malicious scripts and obtain administrator cookies...

XSS Vulnerability at YUNUCMS Friendly Link API

CloudYou CMS is a free + open source urban substation content management system based on TP5.0 framework as the core development. YUNUCMS Friendly Link API at the existence of XSS vulnerability, attackers can exploit the vulnerability to obtain the administrator's cookies...

5iSNS Content Payment System 1.0.9 suffers from XSS vulnerability

The 5iSNS content payment system integrates functional modules such as post articles and documents with social features. An XSS vulnerability exists in 5iSNS Paid-for-Content System 1.0.9, which can be exploited by an attacker to obtain administrator cookie information and log into the backend of...

XSS Vulnerability in Xi'an Sunrise Information Technology Co.

Ltd. is a high-tech enterprise providing comprehensive e-commerce consulting and solutions based on the Internet in China. Xi'an Sunrise Information Technology Co., Ltd. station building system XSS vulnerability, attackers can use the vulnerability to obtain the background administrator COOKIE...

UKcms has an XSS vulnerability

UKcms is a PHP-based content management system CMS by China Lingji Network Technology. UKcms suffers from an XSS vulnerability, which allows an attacker to insert xss statements in the foreground to obtain administrator cookies in the background...

Zoner < 4.2 - Persistent XSS & IDOR

----- Persistent XSS: ----- 'Address' input field on the 'Local information' block is vulnerable so you can use your payload to steal admin cookies or do some redirects etc. ----- IDOR: ----- POST request https://zoner.fruitfulcode.com/wp-admin/admin-ajax.php?action=deletepropertyactid=XXX=YYY...

XSS Vulnerability in Personal Information Page of E-commerce System of Kunming Aoyuan Technology Co.

Kunming Aoyuan Technology Co., Ltd. is a high-tech enterprise engaged in system development, website construction and other Internet businesses. There is an XSS vulnerability in the personal information page of the e-commerce system of Kunming Aoyuan Technology Co. Ltd, which can be exploited by...