Advantech R-SeeNet - Cross-Site Scripting

Advantech R-SeeNet is vulnerable to cross-site scripting via the devicegraphpage.php script via the is2sim parameter. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. id: CVE-2021-21803 info: name: Advantech R-SeeNet - Cross-Site...

WordPress Stop Spammers <2021.9 - Cross-Site Scripting

WordPress Stop Spammers plugin before 2021.9 contains a reflected cross-site scripting vulnerability. It does not escape user input when blocking requests such as matching a spam word, thus outputting it in an attribute after sanitizing it to remove HTML tags. id: CVE-2021-24245 info: name:...

WordPress Ocean Extra <1.9.5 - Cross-Site Scripting

WordPress Ocean Extra plugin before 1.9.5 contains a cross-site scripting vulnerability. The plugin does not escape generated links which are then used when the OceanWP theme is active. id: CVE-2021-25104 info: name: WordPress Ocean Extra 1.9.5 - Cross-Site Scripting author: Akincibor severity:...

WordPress WooCommerce <1.13.22 - Cross-Site Scripting

WordPress WooCommerce before 1.13.22 contains a reflected cross-site scripting vulnerability via the slider import search feature because it does not properly sanitize the keyword GET parameter. id: CVE-2021-24300 info: name: WordPress WooCommerce 1.13.22 - Cross-Site Scripting author: cckuailong...

WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell)

Pre-authentication reflected XSS in WordPress wp-login.php CVE-2026-64638. The flaw exploits a parser differential between PHP striptags and WordPress KSES. Tags with whitespace after e.g. " area" survive striptags but are normalized to valid HTML by KSES, leading to attacker-controlled DOM...

Microweber < 1.2.17 - Cross-Site Scripting

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. id: CVE-2022-2130 info: name: Microweber 1.2.17 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS vulnerability in the...

osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /scp/directory.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "order" parameter. id: CVE-2018-7193 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...

Keystone 6 Login Page - Open Redirect and Cross-Site Scripting

On the login page, there is a "from=" parameter in URL which is vulnerable to open redirect and can be escalated to reflected XSS. id: CVE-2022-0087 info: name: Keystone 6 Login Page - Open Redirect and Cross-Site Scripting author: ShivanshKhari severity: medium description: | On the login page,...

Gitea 1.22.0 - Cross-Site Scripting

Gitea 1.22.0 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts that get stored on the server and executed in the context of another user's session. id: CVE-2024-6886 info: name: Gitea 1.22.0 - Cross-Site Scripting...

CVE-2024-34716

CVE-2024-34716PoC Plus de détails techniques peuvent être trouvés sur https://ayoubmokhtar.com/post/pngdrivenchainxsstoremotecodeexecutionprestashop8.1.5cve-2024-34716/ Installation pip install -r requirements.txt Utilisation Usage: python exploit.py --url --email --local-ip --admin-path...

CVE-2019-1759-csrf-js-rce

CVE-2019-1759 Bolt-cms 3.6.10 Csrf - xss - rce...

SpaceX-Starlink-Router-Gen-2-XSS

SpaceX / Starlink Routeur Gen 2 XSS CVE-2023-49965 Vous pouvez voir la version coréenne de l'article ici : https://hackintoanetwork.com/blog/2023-starlink-router-gen2-xss-kor TL;DR Une vulnérabilité de type Cross-Site Scripting XSS dans la page captive portal initiale du routeur de deuxième...

CVE-2023-41425-wonderCMS_RCE

CVE-2023-41425-wonderCMSRCE Vulnérabilité de Cross Site Scripting dans Wonder CMS v.3.2.0 à v.3.4.2 permet à un attaquant distant d'exécuter du code arbitraire via un script malveillant téléchargé sur le composant installModule. À des fins éducatives uniquement Nécessite la connaissance de l'URL ...

CVE-2023-30212

CVE-2023-30212 Эксплуатация уязвимости в Ourphp версии 7.2.0, также известной как CVE-2023-30212 Шаг 1. Загрузите и установите Docker в вашу систему Примечание. Я использую Docker, потому что это быстро и легко установить ubuntu. Шаг 2. Настройка среды Docker root@kitploit: docker pull ubuntu...

CVE-2024-6536

설명 이 스크립트는 WordPress용 Zephyr Project Manager 플러그인에서 XSS 취약점이 존재하는 CVE-2024-6536에 대한 PoC입니다. 인증 및 프로젝트 매니저 관리자project manager administrator 권한이 필요합니다. 사용법 root@kitploit: python3 CVE-2024-6536.py -u -p -w 예시: python3 CVE-2024-6536.py -u user -p user -w http://localhost/wordpress 링크...

CVE-2022-41445

CVE-2022-41445 Межсайтовый скриптинг в системе управления записями учителей с использованием CodeIgnitor Предполагаемое описание Уязвимость межсайтового скриптинга XSS в системе управления записями с использованием CodeIgniter 1.0 позволяет злоумышленникам выполнять произвольные веб-скрипты или...

CVE-2023-41425

CVE-2023-41425 CVE-2023-41425 XSS vers RCE, Wonder CMS 3.2.0 = 3.4.2 Utilisation root@kitploit: ➜ CVE-2023-41425 python3 exploit.py Enter target URL RHOST, e.g., http://example.com/loginURL: http://redacted.com/loginURL Enter your local host IP LHOST, e.g., 10.10.14.xxx: xx.xx.xx.xx Enter your...

CVE-2022-25063

CVE-2022-25063 Этот скрипт эксплуатирует уязвимость XSS в маршрутизаторе TPLink WR840N, используя поле для внедрения JavaScript кода...

CVE-2023-2822-demo

CVE-2023-2822-demo Application Flask simple pour implémenter une application web intentionnellement vulnérable afin de démontrer CVE-2023-2822. Basé sur l'article à l'adresse...

SuiteCRM-RCE

CVE-2020-28328 SuiteCRM 원격 코드 실행 - 로그 파일 시스템 설정 및 로그 파일 포이즈닝을 통한 취약점 개요 최근 저는 SuiteCRM에서 두 가지 취약점을 발견했습니다. 이 취약점들은 낮은 권한의 사용자가 기본 운영 체제에서 코드 실행을 달성할 수 있는 공격 체인을 제공합니다. 공격 체인은 크로스 사이트 스크립팅XSS으로, 이를 이용해 크로스 사이트 요청 위조CSRF를 수행할 수 있으며, 애플리케이션 구성을 변조하고 로그 파일을 포이즈닝하여 원격 코드 실행RCE으로 이어집니다. 이 모든 것은 악성...