4023 matches found
Design/Logic Flaw
BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI...
CVE-2018-5370
CVE-2018-5370 affects BizLogic xnami 1.0, a PHP-based image sharing script. The issue is a Cross-Site Scripting (XSS) vulnerability via the comment parameter in the addComment action to the /media/ajax URI. The root cause is insufficient input sanitization on the comment field, enabling injection...
Xnami 1.0 - Cross-Site Scripting
Xnami 1.0 - Cross-Site Scripting Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID:...
Xnami 1.0 - Cross-Site Scripting
Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID: CVE-2018-5370 Xnami facilitates the...
Xnami Image Sharing 1.0 Cross Site Scripting
Exploit Title: Xnami Image Sharing - Persistent XSS Vulnerability Google Dork: " Copyright 2017 xnami. " & 2018 Date: 11-01-2018 Exploit Author: Dennis Veninga Contact Author: d.veninga at networking4all.com Vendor Homepage: bizlogicdev.com Version: 1.0 CVE-ID: CVE-2018-5370 Xnami facilitates the...
Ubiquiti Inc.: Reflected XSS
Due to the lack of sanitisation in the commend area, with a especially crafted message, is possible to execute a XSS with the "preview" function. If a draft is save, is possible to exploit this bug using as and stored-XSS. The "New Discussion" page on the Spanish and Portuguese forums have a...
Paragon Initiative Enterprises: Airship: Persistent XSS via Comment
Affected: Airship 2.0.0 commit 15bdc0d CVSS ---- Medium 6.1 https://www.first.org/cvss/calculator/3.0CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Description ----------- The "name" field of a comment on a blog post is vulnerable to persistent XSS. When replying to a comment, the comment name is...
Vanilla Forums Cross-Site Request Forgery Vulnerability
Vanilla Forums is a Canadian company Vanilla Forums PHP-based open source forum program . A cross-site request forgery vulnerability exists in versions of Vanilla Forums prior to 2.1.5. A remote attacker can exploit this vulnerability to delete topics and comments on the forum...
CVE-2015-7324
Multiple cross-site scripting XSS vulnerabilities in helpers/comment.php in the StackIdeas Komento comkomento component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 img or 2 url tag of a new comment...
CVE-2017-17792
Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...
CVE-2017-17792
Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...
CVE-2017-17792
Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...
Cross site scripting
Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...
CVE-2017-17792
Cross site scripting XSS vulnerability in the markupcleanhref function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment...
BlogoText 'markup_clean_href' function cross-site scripting vulnerability
BlogoText is a lightweight SQLite blogging engine. A cross-site scripting vulnerability exists in the 'markupcleanhref' function in the inc/conv.php file in BlogoText 3.7.6 and earlier versions. A remote attacker can exploit this vulnerability to inject arbitrary JavaScript code with the help of ...
CVE-2017-17649
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter...
CVE-2017-17649
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter...
CVE-2017-17649
Readymade Video Sharing Script 3.2 has HTML Injection via the single-video-detail.php comment parameter...
GitLab -- multiple vulnerabilities
GitLab reports: User without access to private Wiki can see it on the project page Matthias Burtscher reported that it was possible for a user to see a private Wiki on the project page without having the corresponding permission. E-mail address disclosure through member search fields Hugo Geoffro...
EasySNS Minimalist Community groupinfo method, commentadd_callback method suffer from SQL injection vulnerability
EasySNS Minimalist Community is for the new database architecture and program structure, to the group as the basic unit to form an interactive community. A SQL injection vulnerability exists in the groupinfo and commentaddcallback methods of EasySNS Minimalist Community. The vulnerability is due ...