Speed Booster Pack 4.2.0-beta - Authenticated (admin+) RCE

The plugin did not validate its cachingexcludeurls and cachingincludequerystrings settings before outputting them in a PHP file, which could lead to RCE PoC | Authenticated RCE | Caching Exclude URLs / Cached query strings: POST /wp-admin/admin.php?page=sbp-settings HTTP/2 Host: example.com Cooki...

ZrLog Cross-Site Script Vulnerability

ZrLog is a blogging system developed using the Java language. A security vulnerability exists in ZrLog 2.1.3, which can be exploited by remote attackers to inject arbitrary web scripts and stolen administrator cookies via the nickname parameter and gain access to the admin panel...

WP Login Security and History <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)

The plugin did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well -- Payloads: $ " $ " -- PoC 1 | Authenticated...

PT-2023-12115 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.1.2 Moodle version 3.10.1 Description: The issue is related to persistent/stored cross-site scripting XSS due to improper input sanitization on the Additional HTML Section via Header and Footer parameter in...

Pricing Table by Supsystic < 1.9.0 - Authenticated Stored Cross-Site Scripting

The label and datahtml POST parameter are not properly sanitised and escaped before being saved and output back in the page, leading to stored Cross-Site Scripting issues v alert1alert1 instead of the one above v 1.9.0, the edit HTML feature was removed client side but a crafted request could sti...

Expense Tracker 1.0 Cross Site Scripting

Exploit Title: Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting Exploit Author: Shivam Vermacyb3rn3rd Date: 2021-01-05 Vendor Homepage: https://code-projects.org/expense-tracker-in-php-with-source-code/ Software Link: https://code-projects.org Version: 1.0 Category: Web Applicatio...

Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting

Exploit Title: Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting Exploit Author: Shivam Vermacyb3rn3rd Date: 2021-01-05 Vendor Homepage: https://code-projects.org/expense-tracker-in-php-with-source-code/ Software Link: https://code-projects.org Version: 1.0 Category: Web Applicatio...

Click2Magic 1.1.5 - Stored Cross-Site Scripting

Exploit Title: Click2Magic 1.1.5 - Stored Cross-Site Scripting Exploit Author: Shivam Vermacyb3rn3rd Date: 2020-12-25 Google Dork: N/A Vendor Homepage: https://www.click2magic.com/user/agent/index Software Link: https://www.click2magic.com Version: 1.1.5 Category: Web Application Tested on: Kali...

Egavilanmedia User Registration & Login System Cross-Site Scripting Vulnerability (CNVD-2021-01547)

Egavilanmedia User Registration & Login System is a management platform for user registration and login from Egavilanmedia, USA. A cross-site scripting vulnerability exists in EGavilanMedia User Registration and Login System With Admin Panel version 1.0, which can be exploited by an attacker to...

WP Postratings < 1.86.1 - Authenticated Stored Cross-Site Scripting

The plugin does not sanitise the postratingsimage parameter from its options page wp-admin/admin.php?page=wp-postratings/postratings-options.php. Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfilteredhtml...

Media Library Assistant < 2.90 - Authenticated Blind SQL Injection

The Media Library Assistant WordPress plugin was affected by an authenticated admin+ blind SQL injection vulnerability when there is at least one Custom Field Rule set in the plugin's options. There need to be at least one Custom Field Rule in the plugin Custom Fields settings...

CVE-2020-16270

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of...

XSS Vulnerability in Situ CMS

Situ CMS is the short name of Situ Tourism Website Management System, which is a self-developed website management system applicable to the construction of tourism websites. An XSS vulnerability exists in SITO CMS, which can be exploited by attackers to obtain an administrator cookie...

Stored XSS Vulnerability in Jeesite Framework

JeeSite is an enterprise information technology development infrastructure platform , Java enterprise applications open source framework. Jeesite framework has a stored XSS vulnerability that can be exploited by an attacker to obtain administrator cookie information...

XSS vulnerability in Extreme CMS (CNVD-2020-38476)

Extreme CMS is an enterprise-level open source content building system. Extreme CMS has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as administrator cookies...

Storage-based cross-site scripting vulnerability exists in the background of enterprise website building system of Zibo Shining Network Technology Co.

Zibo Shining Network Technology Co., Ltd. enterprise station-building system a specialized enterprise station-building solutions for the product. There is a stored cross-site scripting vulnerability in the background of Zibo Shining Network Technology Co. Attackers can use the vulnerability to...

XSS Vulnerability in Xi'an Deyatong Technology Co.

Based on multi-layer cloud computing architecture, DEYATOM CMS makes full use of big data, cloud computing, artificial intelligence and other technologies to build a government website intensification platform with a unified standard system, a unified technology platform, a unified security...

XSS Vulnerability in UQCMS Cloud Business-B2B2C System

UQCMS Cloud Business-B2B2C System Multi-merchant e-commerce system is a B2B2C e-commerce software. UQCMS Cloud Merchant-B2B2C System suffers from an XSS vulnerability that can be exploited by attackers to obtain administrator cookie information...

115CMS suffers from XSS vulnerability

115CMS is a content management system developed with ThinkPHP framework. 115CMS suffers from an XSS vulnerability that can be exploited by attackers to execute malicious scripts and obtain administrator cookies...

XSS Vulnerability at YUNUCMS Friendly Link API

CloudYou CMS is a free + open source urban substation content management system based on TP5.0 framework as the core development. YUNUCMS Friendly Link API at the existence of XSS vulnerability, attackers can exploit the vulnerability to obtain the administrator's cookies...