The vulnerability of the administration panel of D-Link DIR-600M C1 Wi-Fi routers allows a attacker to execute XSS attacks.

The vulnerability of the administration panel of D-Link DIR-600M C1 Wi-Fi routers exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform XSS attacks...

CVE-2024-22733

TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker...

CVE-2024-22733

TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker...

CVE-2024-22733

TP-Link MR200 V4 firmware 210201 is affected by a null-pointer-dereference in the web administration panel at /cgi/login via the sign, Action, or LoginStatus parameters, leading to denial of service by unauthenticated remote/local attackers. The issue affects the web login handler and is document...

Helpdeskz 2.0.2 Cross Site Scripting

Exploit Title: Stored XSS Vulnerability via File Name Google Dork: N/A Date: 08 Aug 2024 Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox...

Helpdeskz v2.0.2 - Stored XSS Vulnerability

Exploit Title: Stored XSS Vulnerability via File Name Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox 115.1.0esr 64-bit CVE : N/A Payload: "...

Helpdeskz v2.0.2 - Stored XSS

Exploit Title: Stored XSS Vulnerability via File Name Google Dork: N/A Date: 08 Aug 2024 Exploit Author: Md. Sadikul Islam Vendor Homepage: https://www.helpdeskz.com/ Software Link: https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip Version: v2.0.2 Tested on: Kali Linux / Firefox...

PT-2024-21646 · Decidim · Decidim

Name of the Vulnerable Software and Affected Versions: Decidim versions prior to 0.27.6 Decidim versions prior to 0.28.1 Description: Decidim is a participatory democracy framework. The admin panel is subject to potential cross-site scripting XSS attack in case the attacker manages to modify some...

CVE-2024-34539

Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions...

XMB 1.9.12.06 - Stored XSS

Exploit Title: Persistent XSS in XMB 1.9.12.06 Date: 06/12/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.xmbforum2.com/ Software Link: https://www.xmbforum2.com/download/XMB-1.9.12.06.zip Version: 1.9.12.06 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent store...

CVE-2024-34539

Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. These credentials can also be used to login to the administration panel and to perform privileged actions...

Bypassing 2FA with phishing and OTP bots

Introduction Two-factor authentication 2FA is a security feature we have come to expect as standard by 2024. Most of todays websites offer some form of it, and some of them wont even let you use their service until you enable 2FA. Individual countries have adopted laws that require certain types ...

PT-2024-37133 · Likeshop · Likeshop

Name of the Vulnerable Software and Affected Versions: Likeshop versions up to 2.5.7 Description: A vulnerability was found in the Merchandise Handler component, affecting some unknown processing of the file /admin. This issue leads to cross-site scripting and can be initiated remotely...

GHSA-GX8M-F3MP-FG99 formwork Cross-site scripting vulnerability in Markdown fields

Impact Users with access to the administration panel with page editing permissions could insert tags in markdown fields, which are exposed on the publicly accessible site pages, leading to potential XSS injections. Patches - Formwork 1.13.0 has been released with a patch that solves this...

FleetCart 4.1.1 Information Disclosure

Exploit Title: FleetCart 4.1.1 - WebPage Content Information Disclosure Exploit Author: CraCkEr Date: 13/05/2024 Vendor: EnvaySoft Vendor Homepage: https://codecanyon.net/item/fleetcart-laravel-ecommerce-system/23014826 Software Demo Link: https://demo.fleetcart.envaysoft.com/en Tested on: Window...

Cross Site Scripting (XSS)

Bonita is vulnerable to Cross Site Scripting XSS. The vulnerability is due to inadequate input validation on a UI screen within the administration panel, allowing malicious scripts to be stored and executed...

GHSA-8VJ9-5V5Q-FHCH Bonita cross-site scripting vulnerability

Bonita before 10.1.0.W11 allows stored XSS via a UI screen in the administration panel...

CVE-2024-27609

Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel...

CVE-2024-27609

Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel...

CVE-2024-27609

Bonita before 2023.2-u2 allows stored XSS via a UI screen in the administration panel...