BookStack 跨站脚本漏洞

BookStack is a platform for storing and organizing information and documents. bookStack suffers from a stored cross-site scripting vulnerability. An attacker could use the vulnerability to obtain administrator cookies, among other things...

BookStack 跨站脚本漏洞

BookStack, a platform for storing and organizing information and documents, is vulnerable to a storage cross-site scripting vulnerability. An attacker could use this vulnerability to obtain administrator cookies, etc...

All Vulnerabilities for turismo.rs.gov.br Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| turismo.rs.gov.br ---|--- Open Bug Boun...

Sensitive Cookie Without 'HttpOnly' Flag in flatpressblog/flatpress

✍️ Description HTTPOnly attribute is not set for session cookies in the application. 🕵️‍♂️ Proof of Concept 💥 Impact When a cookie doesn’t have an HttpOnly flag, it can be accessed through JavaScript, which means that an XSS could lead to cookies being stolen. These include session cookies that can...

FileBrowser Cross-Site Scripting Vulnerability (CNVD-2025-22709)

FileBrowser is an open source web file browser . Provides a file management interface in a specified directory , can be used to upload , delete , preview , rename and edit your files . FileBrowser suffers from a cross-site scripting vulnerability that is caused by improper validation of...

Cross site scripting

WTCMS 1.0 contains a reflective cross-site scripting XSS vulnerability in the page management background which allows attackers to obtain cookies via a crafted payload entered into the search box...

Sensitive Cookie Without 'HttpOnly' Flag in azuracast/azuracast

✍️ Description HTTPOnly attribute is not set for session cookies in the application. 🕵️‍♂️ Proof of Concept 💥 Impact When a cookie doesn’t have an HttpOnly flag, it can be accessed through JavaScript, which means that an XSS could lead to cookies being stolen. These include session cookies that can...

Cross-site Scripting (XSS) - Reflected in zoujingli/thinkadmin

✍️ Description The Application is Vulnerable to reflected XSS Attack. 🕵️‍♂️ Proof of Concept Open the following page in the browser as admin. The 商品名称 field is vulnerable to reflected XSS. An alert box is displayed as PoC...

Cross-site Scripting (XSS) - Reflected in znixbtw/panel-v2

✍️ Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will...

Cross-Site Request Forgery (CSRF) in admidio/admidio

✍️ Description Attacker able to delete any Link with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks it...

Online Traffic Offense Management System 1.0 SQL Injection

Exploit Title: Online Traffic Offense Management System 1.0 - 'id' SQL Injection Authenticated Date: 19/08/2021 Exploit Author: Justin White Vendor Homepage: https://www.sourcecodester.com Software Link:...

WordPress plugin Current Book 'Book Title and Author field' cross-site scripting vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up websites on servers that support PHP and MySQL databases, and can also be used as a content management system CMS. cross-site scripting vulnerability exists in the WordPress plugin Current Book 'Book Title and...

Cross-site Scripting (XSS) - Stored in imran300/inventory

✍️ Description Stored xss bug using a xss payload in the product name when adding a new categorie in the product page. 🕵️‍♂️ Proof of Concept Goto http://localhost/inventory/index.php/Category/listcategory and click on add category and copy paste the following xss payload and paste it in the...

Cross-site Scripting (XSS) - Stored in imran300/inventory

✍️ Description Stored xss bug using a xss payload in the employee name when adding a new employee 🕵️‍♂️ Proof of Concept Goto http://localhost/inventory/employees/addemployee and click on add employee and copy paste the following xss payload and paste it in the EMP NAME javascript " Click on safe...

EyouCms suffers from XSS vulnerability (CNVD-2021-67303)

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework as the core development. EyouCms has an XSS vulnerability that can be exploited by attackers to obtain administrator cookies...

How to automatically accept or disable browser cookies notice on any site

By Sudais Asif You can now use any of these 3 browser extensions to automatically accept or disable browser cookies notice on any website. This is a post from HackRead.com Read the original post: How to automatically accept or disable browser cookies notice on any site...

UPchieve: Widespread CSRF on authenticated POST endpoints

Summary: Cross-Site Request Forgery CSRF is possible on most, if not all, authenticated POST endpoints. While CORS is configured such that the Access-Control-Allow-Origin header is set to Access-Control-Allow-Origin: hackers.upchieve.org, CORS does not prevent CSRF - it only prevents the attacker...

Cross-Site Request Forgery (CSRF) in admidio/admidio

✍️ Description Attacker able to delete any File & Doc with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF...

Cross-site Scripting (XSS) - Stored in leantime/leantime

✍️ Description Stored xss bug using a xss payload in the Retrospectives Title when adding a new retrospective 🕵️‍♂️ Proof of Concept Goto http://localhost/retrospectives/showBoards and click on add more and copy paste the following xss payload in the title javascript " Click on safe and see the xss...

Cross-site Scripting (XSS) - Stored in leantime/leantime

✍️ Description Stored xss bug using a xss payload in the new event title when adding a new event 🕵️‍♂️ Proof of Concept Goto http://localhost/calendar/addEvent and click on add event and copy paste the following xss payload javascript " Click on safe and see the xss popup with the cookie. 💥 Impact...