CVE-2021-36737

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting XSS attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact...

Cross site scripting

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting XSS attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact...

CVE-2021-36737

CVE-2021-36737 affects Apache Pluto UrlTestPortlet within the v3-demo-portlet.war. The input fields are vulnerable to Cross-Site Scripting (XSS) due to insufficient input escaping in UrlTestPortlet, enabling injection of script code. The issue is documented across multiple feeds (NVD/Red Hat/CNVD...

CVE-2021-36737 XSS in V3 Demo Portlet

The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting XSS attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact...

WordPress Catch Themes Demo Import Shell Upload

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress Plugin Catch Themes Demo Import RCE', 'Description' = %q The Wordpress Plugin Catch Themes Demo Import versions MSFLICENSE, 'Author' =...

8x8: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The researcher found a possible HTML injection in one of our demo system webpages caused by improper sanitisation of input data. The issue was swiftly resolved...

Bazaar Web PHP Social Listings Shell Upload Vulnerability

-- Exploit Title: Bazaar Web PHP Social Listings Arbitrary File Upload Exploit Author: Sohel Yousef - email protected Software Link: https://codecanyon.net/item/bazaar-social-listing-shopping-web-php-template/23207913 Software Demo :https://xserver.app/apps/bazaar-web/index.php Category: webapps ...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

log4j-CVE-2021-44228-test demo projects to highlight how to ex...

CVE-2021-44153

CVE-2021-44153 affects Reprise License Manager (RLM) 14.2. An admin user can enable an option while editing the license file to run arbitrary executables, demonstrated by the ISV entry using calc.exe. An attacker can exploit this to run a malicious binary on startup or when triggering the Reread/...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

This is a proof-of-concept exploit for Log4j RCE Unauthenticated...

Inclusion of Sensitive Information in Source Code in pimcore/demo

Description API Keys is hard coded in the application source code. The use of a hard-coded API Key has many negative implications. Proof of Concept "security" = "method" = "datahubapikey", "apikey" = "6332aa5e6d3d6c0be31da2a8b3442113", "skipPermissionCheck" = FALSE...

WordPress Catch Themes Demo Import 1.6.1 Shell Upload

Exploit Title: Wordpress Plugin Catch Themes Demo Import 1.6.1 - Remote Code Execution RCE Authenticated Date 07.12.2021 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://wordpress.org/plugins/catch-themes-demo-import/ Software Link:...

Wordpress Catch Themes Demo Import 1.6.1 Plugin- Remote Code Execution Exploit

Exploit Title: Wordpress Plugin Catch Themes Demo Import 1.6.1 - Remote Code Execution RCE Authenticated Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://wordpress.org/plugins/catch-themes-demo-import/ Software Link:...

IDA2Obj - Static Binary Instrumentation

IDA2Obj is a tool to implement SBI StaticBinary Instrumentation. The working flow is simple: Dump object files COFF directly from one executable binary. Link the object files into a new binary, almost the same as the old one. During the dumping process, you can insert any data/code at any locatio...

New Hub for Lean IT Security Teams

One of the harsh realities of cybersecurity today is that malicious actors and attackers don’t distinguish between organizations that have seemingly endless resources and those operating with lean IT security teams. For these lean teams, meeting the challenges in the current security landscape...

Cross-site Scripting (XSS) - Generic in zikula/core

Description In zikula/core cross site scripting vulnerability is present in block module description field Proof of Concept 1. login to the demo account 2. go to blocks https://demo.ziku.la/blocks/admin/view 3. Add payload in title field and save 4 payload = " Impact This vulnerability is capable...

Cross-site Scripting (XSS) - Stored in zikula/core

Description In zikula/core cross site scripting vulnerability is present in block module title field Proof of Concept 1. login to the demo account 2. go to blocks https://demo.ziku.la/blocks/admin/view 3. Add payload in title field and save 4 payload = " Impact This vulnerability is capable of...

Cross-site Scripting (XSS) - Stored in francoisjacquet/rosariosis

Description I found XSS in the file upload function of the message function. Proof of Concept Step 1.First, access the latest version of the demo environment. "Https://www.rosariosis.org/demonstration/index.php" 2.Then log in with your student account. Student: username and password “student“...

Commvault CommCell Remote Code Execution Vulnerability

Commvault CommCell enables fast, large-scale backup and recovery of virtual machines, structured and unstructured data.A remote code execution vulnerability exists in the DemoExecuteProcessOnGroup workflow in versions of Commvault CommCell prior to 11.25, which could be exploited by an attacker t...

Commvault CommCell 安全漏洞

Commvault CommCell enables fast, large-scale backup and recovery of virtual machines, structured and unstructured data.A remote code execution vulnerability exists in the DemoExecuteProcessOnGroup workflow in versions of Commvault CommCell prior to 11.25, which could be exploited by an attacker t...