Cross-site scripting vulnerability in multiple Lexmark products (CNVD-2020-19522)

The Lexmark CS31x, among others, is a printer from Lexmark USA. A cross-site scripting vulnerability exists in the web server built into several Lexmark products, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute...

HTTP Asynchronous Reverse Shell - Asynchronous Reverse Shell Using The HTTP Protocol

Today there are many ways to create a reverse shell in order to be able to remotely control a machine through a firewall. Indeed, outgoing connections are not always filtered. However security software and hardware IPS, IDS, Proxy, AV, EDR... are more and more powerful and can detect these attack...

IBL Online Weather Cross-Site Scripting Vulnerability

IBL Online Weather is a weather service software from iblsoft. A cross-site scripting vulnerability exists in IBL Online Weather versions prior to 4.3.5a. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerabilit...

Fortinet FortiManager Cross-Site Scripting Vulnerability (CNVD-2020-14765)

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices, and can group devices into different management domains ADOM to further simplify the deployment and management of multi-device...

OpenSMTPD < 6.6.3p1 - Local Privilege Escalation / Remote Code Execution Exploit

/ LPE and RCE in OpenSMTPD's default install CVE-2020-8794 Copyright C 2020 Qualys, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or at...

DotNetNuke CMS 9.5.0 File Extension Check Bypass

Exploit Title: File upload vulnerability through bypassing client-side file extension check Date: 23 Feb 2020 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link: https://github.com/dnnsoftware/Dnn.Platform/releases/download/v9.5.0/DNNPlatform9.5.0Install.zip...

DotNetNuke 9.5 - File Upload Restrictions Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: DotNetNuke 9.5 - File Upload Restrictions Bypass Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link:...

DotNetNuke 9.5 - File Upload Restrictions Bypass

DotNetNuke 9.5 - File Upload Restrictions Bypass Exploit Title: DotNetNuke 9.5 - File Upload Restrictions Bypass Date: 2020-02-23 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link:...

DotNetNuke 9.5 - File Upload Restrictions Bypass

Exploit Title: DotNetNuke 9.5 - File Upload Restrictions Bypass Date: 2020-02-23 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link: https://github.com/dnnsoftware/Dnn.Platform/releases/download/v9.5.0/DNNPlatform9.5.0Install.zip Version: = 9.5 CVE : N/A More...

PrestaShop Cross-Site Scripting Vulnerability (CNVD-2020-13058)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in PrestaShop versions prior to 1.4.11. T...

Synacor Zimbra Collaboration Cross-Site Scripting Vulnerability (CNVD-2020-13200)

Synacor Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A cross-site scripting vulnerability exists in Synacor Zimbra Collaboration versions prior to 8.0.8. The vulnerability stems from the WEB...

NEC Aterm WG2600HS Cross-Site Scripting Vulnerability

The NEC Aterm WG2600HS is a wireless router from Nippon Electric NEC. A cross-site scripting vulnerability exists in the NEC Aterm WG2600HS version 1.3.2, which originates from a WEB application that lacks proper validation of client data. An attacker can exploit the vulnerability to execute...

Synacor Zimbra Collaboration Cross-Site Scripting Vulnerability (CNVD-2020-13201)

Synacor Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A cross-site scripting vulnerability exists in Synacor Zimbra Collaboration versions prior to 8.6.0 patch5. The vulnerability stems from a...

Razer: Reflected XSS on molpay.com with cloudflare bypass

The tester discovered a reflected XSS vulnerability on molpay.com which could allow an adversary to steal client side information such as a cookie. Razer Fintech thanks the tester for his clear report and PoC. Follow brutelogic for amazing bypass tips. Thank you for bounty @razer 🙏...

Netsweeper Cross-Site Scripting Vulnerability (CNVD-2020-10711)

Netsweeper is a Web content filtering solution from Netsweeper Canada. A cross-site scripting vulnerability exists in the webadmin / policy / grouptableajax.php file in versions of Netsweeper prior to 3.1.10, which stems from a lack of proper validation of client-side data by the WEB application...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-10610)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress suffers from a cross-site scripting vulnerability. The vulnerability stems from the WEB application'...

Plone Input Validation Error Vulnerability

Plone is an open source content management system CMS built on the Zope application server. A cross-site scripting vulnerability exists in Plone. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to...

Cross-Site Scripting Vulnerability in Multiple Microsemi Products

Microsemi Symmetricom SyncServer S100 and others are a network time server from Microsemi, USA. A cross-site scripting vulnerability exists in several Microsemi products. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit...

SilverStripe Cross-Site Scripting Vulnerability (CNVD-2020-10132)

SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . SilverStripe 4.4.5 before version 4.5.x and 4.5.2 before version 4.5.x cross-site...

Nextcloud Server, Talk and Deck Cross-Site Scripting Vulnerabilities

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A cross-site scripting vulnerability exists in Nextcloud Server, Talk and Deck. The vulnerability stems from a lack of proper validation of client-side data b...