YetiForce CRM < 3.1 - Persistent Cross-Site Scripting

Exploit for php platform in category web applications Exploit Title: YetiForce CRM Accounts' select your prefered user, and then in the 'Comments' section input; Either refresh the current page, or navigate back to 'Accounts' 0day.today 2018-03-28...

YetiForce CRM < 3.1 - Persistent Cross-Site Scripting

Exploit Title: YetiForce CRM Accounts' select your prefered user, and then in the 'Comments' section input; Either refresh the current page, or navigate back to 'Accounts'...

HackerOne: Manipulate report timeline activity by using null byte.

Null bytes are not permitted in report body, or even in report title. But that can be used in the comment section of self-closing for reporter and change-status for team. When a null byte is used as a comment, that report timeline activity disappears! For example:...

Ourphp CMS 评论处 SQL注入漏洞

No description provided by source...

WordPress Fixes Stored XSS Vulnerability in Akismet

Developers at Automattic, the parent company behind the blogging platform WordPress, fixed a nasty stored cross-site scripting error this week in Akismet, an anti-spam plugin that figures into millions of websites. The bug was fixed Tuesday in an update, 3.1.5, according to Christopher Finke, an...

Yiqicms 存储型XSS

yiqicms 最新版的1.9 留言区，跟1.8版本一样存在相同的问题。在评论区中对标题仅仅限制了30个字符长度的限制，没有进行任何。 if!pregmatch"/^.1,30$/",$msgtitle ShowMsg"请输入正确的标题"; exit; if!pregmatch"/^.1,10$/",$msgname ShowMsg"请输入您的姓名"; exit; if!pregmatch"/^.1,20$/",$msgcontact ShowMsg"请输入正确的联系方式"; exit; if!pregmatch"/^.1,200$/",$msgcontent...

CVE-2012-1503

Cross-site scripting XSS vulnerability in Six Apart formerly Six Apart KK Movable Type MT Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section...

CVE-2012-1503

Cross-site scripting XSS vulnerability in Six Apart formerly Six Apart KK Movable Type MT Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section...

CVE-2012-1503: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Six Apart formerly Six Apart KK Movable Type MT Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section...

Slack: CSRF on add comment section

Hi, Steps to repro: 1 Go to this link https://sehacure.slack.com/help/requests/237956 2 The malicious guy should now the request number and the username. 3 Open Tamper data using tamper data firefox addon,Fill the reply in the form. 4 Submit the request.You will see there are no anti-csrf token i...

Movable Type Pro 5.13en Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html Keywords: CVE-2012-1503, Movable Type Pro 5.13en, Stored XSS, JavaScript Injection, Vendor Unresponsive, Full Disclosure Introduction Movable Type MT started as on...

CVE-2012-2156

Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...

CVE-2012-2156

Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...

PlumeCMS <= 1.2.4 Multiple Persistent XSS

Exploit for php platform in category web applications +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : PlumeCMS = 1.2.4 Multiple Persistent XSS Date : 04-04-2012 Author : Ivano Binetti...

Micro CMS v1.0 b1 Persistent XSS Vulnerability

Exploit for php platform in category web applications ============================================== Micro CMS v1.0 b1 Persistent XSS Vulnerability ============================================== Class: Persistent Cross-Site Scripting Severity: High Overview: --------- Micro CMS is prone to...

CVE-2008-2698

Multiple cross-site scripting XSS vulnerabilities in photoadd-c.php aka the "add comment" section in WEBalbum 2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 comment, 2 id, or 3 category parameter...

webalbum-xss.txt

================================================================ WEBAlbum XSS Vulnerabilities POST Variable: id POST Variable: category Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, Win7dos, JabAv0C...

CVE-2003-1546: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in gbook.php in Filebased guestbook 1.1.3 allows remote attackers to inject arbitrary web script or HTML via the comment section...

CVE-2006-4091

Multiple cross-site scripting XSS vulnerabilities in Archangel Management Archangel Weblog 0.90.02 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Comment section...

CVE-2005-4785: Undefined Security Weakness

Cross-site scripting XSS vulnerability in QuickBlogger 1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 author "your name" and 2 "comment" section...