MTN Group: Reflected Cross-Site scripting in : mtn.bj

Hello Team I have found a Reflected XSS vulnerability in mtn.jb by file name Steps To Reproduce: add details for how we can reproduce the issue 1. go to : https://www.mtn.bj/business/ressources/formulaires/formulaire-dutilisation-du-service-mtn-corporate-bulk-sms/?suscribeTo=Sms-Pro 2. enter any...

Froala WYSIWYG Editor 跨站脚本漏洞

Froala WYSIWYG Editor is an application. Froala WYSIWYG Editor is a cross-site scripting vulnerability that stems from an obfuscation of namespace resolution in the product. An attacker could exploit this vulnerability to obtain an administrator cookie...

Cross-Site Request Forgery (CSRF) in emoncms/emoncms

✍️ Description In CSRF attack if your users going to attacker website and click the mallicouse link then they able to steal users cookie, submit unwanted date, .... 🕵️‍♂️ Proof of Concept 1.you login in your account 2.you make a file contain the following html file. 3.open html as victim site...

Stored XSS Vulnerability in the Smart Gateway Configuration Platform of Beijing Bibi Technology Co.

Ltd. is a company with professional Wi-Fi technology, which is committed to combining Internet technology with traditional industries to help industry customers embrace the Internet and create new value for traditional industries. There is a stored XSS vulnerability in the Smart Gateway...

Stored XSS Vulnerability in 189 Mailbox of China Telecom Group Corporation Ltd.

189 Mailbox is a new type of work and business mailbox for all Internet users. A stored XSS vulnerability exists in China Telecom Group Corporation's 189 mailbox, which can be exploited by attackers to obtain sensitive information such as user cookies...

Description of the security update for Microsoft Exchange Server 2013: July 13, 2021 (KB5004778)

Description of the security update for Microsoft Exchange Server 2013: July 13, 2021 KB5004778 This security update rollup resolves vulnerabilities in Microsoft Exchange Server. To learn more about these vulnerabilities, see the following Common Vulnerabilities and Exposures CVE: CVE-2021-31196 |...

CVE-2020-19037

Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies...

CVE-2020-19037

Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies...

Improper access control

Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies...

CVE-2020-19037

Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies...

HadSky has an XSS vulnerability (CNVD-2021-55203)

HadSky is a PHP + MySQL based open source forum program. HadSky has an XSS vulnerability. Attackers can use this vulnerability to obtain sensitive information such as user cookies...

in erudika/scoold

Reuse of cookies: The cookies are not expiring after sign out. Once the user signs out of his account, the cookies needs to be expired and should not be any use of reuse. But in this case, an attacker can grab the cookies and use them to log them into a user's account POC: 1Go to...

Mail.ru: Blind XSS Stored and CORS misconfiguration в отчете "События" сервиса top.mail.ru

Details: Прежде чем начать, хотелось бы отметить что в правилах по XSS сказано including privilege escalations within the product are accepted without bounty, однако полученные таким образом Cookies жертвы не привязаны к домену продукта top.mail.ru. Вот пример, Cookies: ██████████ Domain, site,...

Cross-site Scripting (XSS) - Reflected in leantime/leantime

✍️ Description Reflected XSS in editBoxDialog.tpl.php where "module" and "label" parameters leads to exploitation of a vulnerability. 🕵️‍♂️ Proof of Concept Open this link http://127.0.0.1/setting/editBoxLabel?module=idealabels%22%3E%3Cscript%3Ealert%22XSS%20by%20OverJT%22%3C/script%3E&label=jjj 💥...

WordPress Plainview Activity Monitor 20161228 Remote Code Execution

Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution RCE Authenticated 2 Date: 07.07.2021 Exploit Author: Beren Kuday GORUN Vendor Homepage: https://wordpress.org/plugins/plainview-activity-monitor/ Software Link:...

Mblog is vulnerable to XSS

Mblog is an open source Java blog system , support for multiple users , support for switching themes . Mblog has an XSS vulnerability that can be exploited by attackers to obtain sensitive information such as user cookies...

WordPress Easy Cookies Policy Plugin Cross-Site Scripting Vulnerability (CNVD-2021-49075)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL server set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress Easy...

CVE-2021-35440

Smashing 1.3.4 is vulnerable to Cross Site Scripting XSS. A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment e.g. if re-using internal URL's for...

Cross site scripting

Smashing 1.3.4 is vulnerable to Cross Site Scripting XSS. A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment e.g. if re-using internal URL's for...

Cross-site Scripting (XSS) - Stored in sergix44/xbackbone

✍️ Description Stored xss through file upload via a .svg file 🕵️‍♂️ Proof of Concept Upload a .svg file with the following content: javascript alertdocument.cookie; give a name you want ending with .svg store-xss.svg for example and upload the file, after upload click on open click on raw see the...