5599 matches found
InoERP 0.7.2 - Persistent Cross-Site Scripting
Exploit Title: InoERP 0.7.2 - Persistent Cross-Site Scripting Google Dork: None Date: 2019-09-14 Exploit Author: strider Vendor: http://inoideas.org/ Software Link: https://github.com/inoerp/inoERP Version: 0.7.2 Tested on: Debian 10 Buster x64 / Kali Linux CVE : None...
Arbitrary File Upload Vulnerability in Guojiz
Guojiz is a light community system based on layui front-end framework and thinkphp. Guojiz has an arbitrary file upload vulnerability, which can be exploited by an attacker to upload any type of image, such as a php Trojan horse, when editing a forum post or adding a comment via the upload image...
CVE-2019-16665
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
PT-2019-14751
Name of the Vulnerable Software and Affected Versions ThinkSAAS version 2.91 Description An issue was discovered where there is a potential for XSS via the content to the "index.php?app=group&ac=comment&ts=do&js=1" URI. This can be demonstrated by a crafted SVG document in the SRC attribute of an...
CVE-2019-15731: Server-Side Request Forgery (SSRF)
An issue was discovered in GitLab Community and Enterprise Edition 12.0 through 12.2.1. Non-members were able to comment on merge requests despite the repository being set to allow only project members to do so...
CVE-2019-6995
An issue was discovered in GitLab Community and Enterprise Edition 8.x, 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. Users are able to comment on locked project issues...
WordPress Sell Downloads 1.0.86 Plugin - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting Exploit Author: Mr Winst0n Author E-mail: email protected Discovery Date: September 09,2019 Vendor Homepage:...
WordPress Sell Downloads 1.0.86 Cross Site Scripting
Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: September 09,2019 Vendor Homepage: https://wordpress.dwbooster.com/content-tools/sell-downloads Software Link :...
FreeType Buffer Overflow Vulnerability (CNVD-2019-30720)
FreeType is an open source font rendering library written in the C language. A buffer overflow vulnerability exists in the skipcomment file in psaux/psobjs.c in versions of FreeType prior to 2.6.1. The vulnerability stems from a networked system or product performing operations in memory without...
WordPress feature-comments plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. feature-comments is a comment management plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...
PT-2019-12319
Name of the Vulnerable Software and Affected Versions Django CRM version 0.2.1 Description The issue affects the Django CRM, where multiple CSRF problems exist. These issues are found in various API endpoints, including "/change-password-by-admin/", "/api/settings/add/", "/cases/create/",...
Scientific Linux Security Update : fence-agents on SL7.x x86_64 (20190806)
fence-agents: mis-handling of non-ASCII characters in guest comment fields CVE-2019-10153 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128217; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...
Django CRM 0.2.1 Cross Site Request Forgery Vulnerability
Exploit for php platform in category web applications Information -------------------- Advisory by Netsparker Name: Multiple CSRF Vulnerabilities in Django CRM 0.2.1 Affected Software: Django CRM Affected Versions: 0.2.1 Homepage: https://github.com/MicroPyramid/Django-CRM Vulnerability: Cross-si...
WordPress embed-comment-images plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. embed-comment-images is a plugin that supports embedding image links in comments. A cross-site scripting vulnerability exists in the...
CVE-2014-10382
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment...
CVE-2014-10382
The CVE-2014-10382 vulnerability affects the WordPress feature-comments plugin prior to version 1.2.5. It is a cross‑site request forgery (CSRF) flaw that allows an attacker to perform actions like featuring or burying comments by authenticated/unauthenticated users depending on the context descr...
CVE-2014-10382: Cross-Site Request Forgery (CSRF)
The feature-comments plugin before 1.2.5 for WordPress has CSRF for featuring or burying a comment...
CVE-2017-18561
The embed-comment-images plugin before 0.6 for WordPress has XSS...
CVE-2017-18561
The CVE-2017-18561 entry concerns the WordPress plugin embed-comment-images with an XSS vulnerability in versions before 0.6. Connected sources consistently describe Cross-Site Scripting in this plugin, evidenced by references noting XSS and a PoC demonstrating an image tag-based vector (e.g., un...
