5268 matches found
PaulPrinting CMS Printing 1.0 - SQL Injection
Exploit Title: PaulPrinting CMS Printing 1.0 - SQL Injection Exploit Date: 2018-05-19 Software Link: https://codecanyon.net/item/paulprinting-cms-printing-solutions/19546365 Author: Mehmet Onder Key Version: 1.0 Tested On: Linux 1. Description Any visitor can run code to exploit css and sql...
GitBackdorizer - Is A Proof Of Concept That Uses The Lack Of User Attention To Steal Git Access Credentials
GitBackdorizer is a proof of concept, fully inspired in Ulisses Castro's 50 ton of backdoors talk, that abuses the lack of user attention to steal git access credentials. How it Works GitBackdorizer consists of three pieces: handler, dropper and the payload. Handler The handler sets up a HTTP...
Design/Logic Flaw
ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...
CVE-2018-10665
ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...
CVE-2018-10665
CVE-2018-10665 : A cross-site scripting (XSS) vulnerability affects ILIAS 5.3.4, caused by unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files. Multiple connected sources (Red Hat, CNVD, NVD, OSV, CVE lists) confirm the issue as an XSS in ILIAS 5.3.4. The provide...
CVE-2018-10665
ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...
How to Make Your Demo Environment Easy, Accessible...AND Secure
A common misconception I've heard in the field is that a tradeoff exists between easy access for applications and network security. For example, companies want to allow their sales team, partners, and prospects access into demo environments. With traditional access solutions, there is a question ...
spreadhub.com XSS vulnerability
Open Bug Bounty ID: OBB-601419 Description| Value ---|--- Affected Website:| spreadhub.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
iScripts SonicBB 1.0 Cross Site Scripting
Exploit Title: iScripts SonicBB 1.0 - Reflected Cross-Site Scripting Date: 02/04/2018 Exploit Author: ManhNho Vendor Homepage: https://www.iscripts.com Demo Page: https://www.demo.iscripts.com/sonicbb/demo/ Version: 1.0 Tested on: Windows 10 Category: Webapps CVE: CVE-2018-9235 1. Description...
Microsoft Sharepoint 14.x Cross Site Scripting Vulnerability
Exploit for asp platform in category web applications + Title: Microsoft-sharepoint FilterValue Cross Site Scripting XSS + Date: 2018/04/04 + Author: Mostafa Gharzi + Team: Maher - CertCC.ir + Vendor Homepage: https://products.office.com/en-us/sharepoint/collaboration + Tested on: Windows 10 & Ka...
Domaintrader 2.5.3 Cross Site Scripting
i? Domaintrader v.2.5.3 Cross-Site Scripting 6th of February, 2018 Found by Uladzislau Murashka - https://sm0k3.net Vendor homepage: www.smartscriptsolutions.com Software link: http://www.smartscriptsolutions.com/domain-trader/ Version of local application copy: 2.5.2 but valid also for 2.5.3...
Upserve : Blind stored xss in demo form
Through Upserve's demo request form, @pareshparmar found a blind XSS in a 3rd party package for Upserve's CRM system. While the CRM system and 3rd party package are out of scope for our program, we decided to reward @pareshparmar for his work in bringing this issue to our attention. - Endpoint...
Rockstar Games: Exploiting Misconfigured CORS to Steal User Information
In this report, the researcher demonstrated how a CORS misconfiguration was allowing user details, such as email addresses and IDs, to be shared inappropriately. They also provided a POC which showed how an attacker could exploit this remotely. This issue was resolved in a platform update to our...
Taxi Booking Script 1.0 Cross Site Scripting
Exploit Title: Taxi Booking Script v1.0 - Cross-site Scripting XSS Date: 11.01.2018 Vendor Homepage: https://www.phpjabbers.com/taxi-booking-script/ Software Link: Demo: http://demo.phpjabbers.com/1515648238792/index.php?controller=pjAdminUsers&action=pjActionIndex&err=AU01 Version: 1.0 Category:...
WordPress MQ ReLinks 1.8 XSS / Open Redirection
Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable MQ ReLinks 1.8 MQ ReLinks is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to execute arbitrary script code in the...
Cross-site Scripting (XSS)
MapProxy is vulnerable to cross-site scripting XSS attacks. Attackers can use the format and srs parameters in the demo page to inject and execute arbitrary webscript...
MapProxy Cross-Site Scripting Vulnerability
MapProxy is an open source geospatial data proxy that caches, accelerates and transforms existing map service data. A cross-site scripting vulnerability exists in the demo service in MapProxy 1.10.3 and earlier versions. A remote attacker can exploit this vulnerability to obtain information...
DEBIAN-CVE-2017-1000426
MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information disclosure...
