Rumble Mail Server 0.51.3135 Cross Site Scripting

Exploit title: Rumble Mail Server v/0.51.3135 = Stored Cross Site Scripting Download Software: https://sourceforge.net/projects/rumble/?source=directory Author: Nassim Asrir Author Company: Henceforth Contact: [email protected] Tested On: Win7 What is Rumble: --------------------------------...

Xfinity Gateway (Technicolor DPC3941T) - Cross-Site Request Forgery Vulnerability

Exploit for hardware platform in category web applications Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Date: 09/08/2016 Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The Device DPC3941T is vulnerable to...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/media.php and admin/mediaitem.php in Dotclear before 2.11 allows remote authenticated users to inject arbitrary web script or HTML via the upfiletitle or mediatitle parameter aka the media title...

XFINITY Gateway Technicolor DPC3941T Cross Site Request Forgery Vulnerability

XFINITY Gateway Technicolor DPC3941T wifi password changing cross site request forgery proof of concept code. Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The...

XFINITY Gateway Technicolor DPC3941T Cross Site Request Forgery

Exploit Title: CSRF XFINITY Gateway product Technicolorpreviously Cisco DPC3941T Date: 12/12/2016 Exploit Author: Ayushman Dutta Version: dpc3941-P20-18-v303r20421733-160413a-CMCST CVE : CVE-2016-7454 The Device DPC3941T is vulnerable to CSRF and has no security on the entire admin panel for it...

NETGEAR R7000 - Cross-Site Scripting

NETGEAR R7000 - Cross-Site Scripting Exploit Title: Netgear R7000 - XSS via. DHCP hostname Date: 11-12-2016 Exploit Author: Vincent Yiu Contact: https://twitter.com/vysecurity Vendor Homepage: https://www.netgear.com/ Category: Hardware / WebApp Version: V1.0.7.21.1.93 + LATEST to date...

Netgear R7000 - Cross-Site Scripting Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Netgear R7000 - XSS via. DHCP hostname Date: 11-12-2016 Exploit Author: Vincent Yiu Contact: https://twitter.com/vysecurity Vendor Homepage: https://www.netgear.com/ Category: Hardware / WebApp Version: V1.0.7.21.1.93 +...

Netgear R7000 - Cross-Site Scripting

Exploit Title: Netgear R7000 - XSS via. DHCP hostname Date: 11-12-2016 Exploit Author: Vincent Yiu Contact: https://twitter.com/vysecurity Vendor Homepage: https://www.netgear.com/ Category: Hardware / WebApp Version: V1.0.7.21.1.93 + LATEST to date -Vulnerability An user who has access to send...

Nextcloud: Login Hints on Admin Panel

Hi, Hope you are doing fine. I wanted to inform you regarding the enabling of the login hints on your wp-admin panelhttps://nextcloud.com/wp-login.php. Vulnerability: The admin panel shows very "specific" hint information if a hacker tries for a bruteforcing attack. Steps to reproduce: 1. Navigat...

Starbucks: Stored XSS in Adress Book (starbucks.com/account/profile)

Hello, I just found a stored XSS in the "Adress book menu" of a user's profile : https://www.starbucks.com/account/profile Description : XSS is happening due to the lack of filtering on the Address.FirstName parameter when you POST a new address on the URL :...

WordPress Caldera Forms 1.3.5.3 Cross Site Scripting Vulnerability

WordPress Caldera Forms plugin version 1.3.5.3 suffers from a cross site scripting vulnerability. ------------------------------------------------------------------------ Cross-Site Scripting vulnerability in Caldera Forms WordPress Plugin...

WordPress WassUp Real Time Analytics 1.9 Plugin - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptinginwassuprealtimeanalyticswordpressplugin.html Persistent Cross-Site Scripting in WassUp Real Time Analytics WordPress Plugin Abstract A stored Cross-Site Scripting XSS...

GitLab 任意用户 authentication tokens 泄漏导致远程代码执行漏洞

漏洞分析参考： http://paper.seebug.org/104/ The project export feature serializes the user objects of team members and stores it in the project.json file. This object contains the authenticationtoken for every user, meaning that an attacker can simply go ahead and create a project on GitLab.com, add one...

WordPress Plugin WassUp Real Time Analytics 1.9 - Persistent Cross-Site Scripting

Source: https://sumofpwn.nl/advisory/2016/persistentcrosssitescriptinginwassuprealtimeanalyticswordpressplugin.html Persistent Cross-Site Scripting in WassUp Real Time Analytics WordPress Plugin Abstract A stored Cross-Site Scripting XSS vulnerability has been found in the WassUp Real Time...

Boonex Dolphin 7.3.2 - Authentication Bypass

Boonex Dolphin 7.3.2 - Authentication Bypass Exploit Title : Boonex Dolphin all versoin array This will allow the attacker to bypass the authentication and can also enter in admin panel. Independent Pakistani Security Researcher...

Boonex Dolphin 7.3.2 - Authentication Bypass

Exploit Title : Boonex Dolphin all versoin array This will allow the attacker to bypass the authentication and can also enter in admin panel. Independent Pakistani Security Researcher...

Boonex Dolphin 7.3.2 - Authentication Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title : Boonex Dolphin all versoin array This will allow the attacker to bypass the authentication and can also enter in admin panel. Independent Pakistani Security Researcher 0day.today 2018-02-15...

OneBlog 2.0 Cross Site Scripting

Exploit Title :----------------- : Oneblog v2.0 - postsnew.php - Stored XSS Author :------------------------ : Nassim Asrir Author Company :------------------------ : HenceForth Author Email :------------------------ : [email protected] Google Dork :---------------- : - Date...

Oneblog 2.0 Cross Site Scripting

Exploit Title :----------------- : Oneblog v2.0 - postsnew.php - Stored XSS Author :------------------------ : Nassim Asrir Author Company :------------------------ : HenceForth Author Email :------------------------ : [email protected] Google Dork :---------------- : - Date...

RSS News AutoPilot Script 1.0.1 / 3.1.0 - Admin Panel Authentication Bypass

Exploit for php platform in category web applications Exploit Title: RSS News AutoPilot Script - Admin Panel Authentication Bypass Date: 14 October 2016 Exploit Author: Arbin Godar Website : ArbinGodar.com Software Link: https://codecanyon.net/item/rss-news-autopilot-script/11812898 Version: 1.0....