Open Redirect in erudika/scoold

Description Hi erudika scoold team, there is an Open redirect in your source code at question url Proof of Concept 1. Go to this link https://pro.scoold.com/questions/space?returnto=https://google.com 2. Observe that you are redirected to google.com Impact This vulnerability is capable of Open...

TikTok: Cross site scripting via file upload in subdomain ads.tiktok.com

A file upload XSS cross-site scripting vulnerability was found in TikTok ads ticketing platform. Due to missing checks it was possible to upload .svg files which contained XSS payload. We thank @blubluuu for reporting this to our team and confirming its resolution...

Cross-site Scripting (XSS) - Stored in admidio/admidio

Description When adding a menu after logging in with an administrator account, there is no verification of the URL value, so the XSS payload is stored in the DB. After that, when you click the saved menu, XSS is triggered. If an administrator adds a menu, normal users can click it too. Proof of...

Acronis: [forum.acronis.com] JNDI Code Injection due an outdated log4j component

Vulnerability description not provided...

Cross-site Scripting (XSS) - Reflected in opensourcepos/opensourcepos

Description Reflected Cross site scripting vulnerability in barcode field and name field in itemkits category Proof of Concept 1. Login to the demo account 2. Go to item kits , edit any item and add payload in barcode field and click save 3. payload " 4. poc 1 https://ibb.co/ZJZLKdQ 5. poc 2...

Cross-Site Request Forgery (CSRF) in janeczku/calibre-web

Description CSRF on various endpoints Summary Pretty recently CSRF protection in calibre-web was implemented. However, there are some state-changing endpoints that accept GET requests instead of POST. The most impactful route so far, that allows to completely shutdown the server:...

Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

Description I found one more CSRF at Clean cache in the System tab of System configuration via GET request. Proof of Concept CLICK ME! Impact This vulnerability is capable of tricking admin to clear the cache of the system, that can potential lead to a DoS attack. Remediation Use POST request...

skidor.com Cross Site Scripting vulnerability OBB-2304185

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Judge.me : stored XSS on AliExpress Review Importer/Products when delete product

Hi @judgeme! code Step to reproduce: 1. Go to Shopify admin and create product with name "" img src=x onerror=prompt 2. Go to AliExpress Review Importer/Products and delete our product with name " img src=x onerror=promptdocument.domain F1544890 3. Xss work= P.S. Poc wideo attach F1544893 Impact...

U.S. Dept Of Defense: ██████████ running a vulnerable log4j

Description: https://vulners.com/cve/CVE-2021-44228 Impact Probably arbitrary code execution System Hosts ████████ Affected Products and Versions CVE Numbers CVE-2021-44228 Steps to Reproduce 1. Browse to https://████████/███████https%3A%2F%2F█████████%2F 2. Enter a...

Cross-site Scripting (XSS) - Stored in openwhyd/openwhyd

Description openwhyd is vulnerable to Stored XSS at the Name field in User Profile. Payload " Steps to reproduce 1.After login, click on the username to go to the Profile page 2.Click Edit Profile button - choose Edit Profile Info 3.In the Name field, input payload "then click Save button 4.Reloa...

X (Formerly Twitter): Link-shortener bypass (regression on fix for #1032610)

Report 1032610, entitled Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking links was closed as Resolved about six months ago. However, a regression on the fix for the vulnerability in question seems to have occurred, and the bug is reproducible with the...

Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton

Description Shared notes panel is vulnerable to XSS when rendering a new note, due to missing username sanitization. Proof of Concept 1. 1.Start a new web conference and share the link with other people 2. 2.A malicious user joins the conference with the following username: 3. 3.As soon as the...

TikTok: Clickjacking Vulnerability In Whole Page Ads Tiktok

A clickjacking vulnerability was found on a TikTok Ads endpoint, where an attacker, once obtaining the ID, could trick another user to perform actions such as creating or deleting campaigns. We thank @rioncool22 for reporting this to our team...

Cross-Site Request Forgery (CSRF) in splitbrain/dokuwiki

Description DokuWiki is vulnerable to CSRF in enabling / disabling plugin due to missing CSRF token sectok Proof of Concept If a logged-in admin user visits an attacker's website with the following HTML code the LDAP plugin, for example, will be disabled Impact This vulnerability is capable of...

Cross-Site Request Forgery (CSRF) in babybuddy/babybuddy

Description An attacker is able to log out a user if a logged-in user visits the attacker's website. Proof of Concept history.pushState'', '', '/' document.forms0.submit; Impact This vulnerability is capable of forging users to unintentional logout. More details One way GET could be abused here i...

Courier: Missing SPF record on trycourier.app

Missing SPF record on trycourier.app domain which has been retired a while ago...

Django: Deserialization of potentially malicious data to RCE

Hello, Django Team! It's my first time working with you, hope it will be great! Note: I have not seen this issue neither in known vulnerabilities nor in documentation, so here I am. Summary Several type of caches in https://github.com/django/django/tree/main/django/core/cache/backends use python...

in qmpaas/leadshop

Description The vulnerability is in the api/ImageController.php file. When $type is 2, it will enter the logic for uploading video files. However, the function $upload-video that handles video uploads does not detect the file suffix name. This results in arbitrary file uploads. Proof of Concept...

menbur.pl Cross Site Scripting vulnerability OBB-2287945

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...