AeroCMS 0.0.1 Cross Site Scripting Vulnerability

AeroCMS-Comment-StoredXSS-POC Author: D4rkP0w4r Note = Don't need register or login account Description = StoredXSS at comment box Step to Reproduct Click Read More - input payload at Author - click Submit button Exploit Input payload at Author - click Submit button When admin login to admin pane...

Ecommerce-Website 代码问题漏洞

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql.Ecommerce-Website is vulnerable to file uploads, which can be exploited by attackers to execute arbitrary code via carefully crafted PHP files...

AeroCMS 0.0.1 Shell Upload Exploit

AeroCMS-Unrestricted-File-Upload-POC Author: D4rkP0w4r Description = Upload web shell at Post Image in admin panel Step to Reproduct Login to admin panel - Posts - Add Posts - Post Image - upload malicious file shell.php - access /images/shell.php on url - shell.php page Exploit When upload succe...

Server Side Template Injection

Description Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system. PoC video. Proof of Concept Payload: 'cat\x20/etc/passwd'|filter'system' 1. With an authenticated user,...

CVE-2021-43432

A Cross Site Scripting XSS vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp...

CVE-2021-43432

A Cross Site Scripting XSS vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp...

CVE-2021-43432

A Cross Site Scripting XSS vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp...

CVE-2021-43432

The CVE-2021-43432 entry concerns an XSS vulnerability in the Exrick XMall Admin Panel, exploitable via a GET parameter on the product-add.jsp page. Affected software is Exrick XMall Admin Panel; the vulnerability arises from improper handling of user-supplied input in that JSP, enabling script e...

PT-2022-11836 · Unknown · Exrick Xmall Admin Panel

Name of the Vulnerable Software and Affected Versions: Exrick XMall Admin Panel affected versions not specified Description: A Cross Site Scripting XSS issue exists in the Exrick XMall Admin Panel, specifically via the GET parameter in the product-add.jsp page. This allows for potential malicious...

Exrick XMall 跨站脚本漏洞

Exrick XMall is a distributed e-commerce shopping mall based on SOA architecture. A security vulnerability exists in the Exrick XMall Admin Panel, which originates from a GET parameter in product-add.jsp...

Ecommerce-Website 代码问题漏洞

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. v1.1.0 of Ecommerce-Website is vulnerable to a file upload vulnerability, which stems from a lack of file upload restrictions in public/admin/index.php?addproduct The vulnerability is caused...

Page Restriction WordPress < 1.2.7 - Admin+ Stored Cross-Site Scripting

The plugin allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator users. In Page/Post Access tab, Use XSS Payload as "alert'XSS' in any of the pages available. XSS wi...

CSZ CMS 1.2.9 - Multiple Blind SQL injection (Authenticated) Vulnerability

Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Blind SQLiAuthenticated Exploit Author: Rahad Chowdhury Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.2.9.zip Version: 1.2.9 Tested on: Windows 10, Kali Linux, PHP 7.4.16, Apache...

CSZ CMS 1.2.9 SQL Injection

Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Blind SQL Injection Authenticated Date: 2021-04-14 Exploit Author: Rahad Chowdhury Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.2.9.zip Version: 1.2.9 Tested on: Windows 10, Kali...

Virtuozzo Hybrid Infrastructure 5.4 Update 1 (5.4.1-59)

This update provides new features, as well as stability fixes for the compute and core storage services. Vulnerability id: VSTOR-62742 A VM creation fails with the error 'Unable to update the attachment.' Vulnerability id: VSTOR-65824 Some charts in the admin panel or Grafana dashboard may be...

Cross site scripting

Maccms v10 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters...

Cross site scripting

Maccms v10 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters...

Cross site scripting

Maccms v10 was discovered to contain a reflected cross-site scripting XSS vulnerability in /admin.php/admin/plog/index.html via the wd parameter...

CVE-2020-21554

A File Deletion vulnerability exists in TinyShop 3.1.1 in the backlist parameter in controllers\admin.php, which could let a malicious user delete any file such as install.lock to reinstall cms...