Cross site scripting

A cross-site scripting XSS vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934 and CVE-2019-13182...

Serv-U FTP Server 15.1.7 Cross Site Scripting

Exploit Title: Stored Cross-Site Scripting Date: 16/12/2019 Exploit Author: Cyb0r9 Vendor Homepage: https://www.serv-u.com/ Software Link: https://www.serv-u.com/downloads Version: SOLARWIND Serv-U FTP Server v15.1.7 Tested on: Windows 10 x64 CVE : CVE-2019-19829 Overview The application is...

Serv-U FTP Server 15.1.7 Cross Site Scripting Vulnerability

Exploit for windows platform in category web applications Exploit Title: Serv-U FTP Server 15.1.7 Cross Site Scripting Vulnerability Exploit Author: Cyb0r9 Vendor Homepage: https://www.serv-u.com/ Software Link: https://www.serv-u.com/downloads Version: SOLARWIND Serv-U FTP Server v15.1.7 Tested...

Clario: RXSS on unsubscribe feature (affiliates.kromtech.com)

Summary Reflected Cross-Site Scripting attack on affiliates.kromtech.com domain. The problem in email parameter in /unsubscribe script that takes GET parameter and pass value of this parameter directly to HTML code of the page. Step to reproduce...

Information Disclosure

cloudfoundry-identity-server is vulnerable to information disclosure. A remotely authenticated attacker with scim.invite scope is able to obtain information about users of the UAA via blind SCIM injection through the email parameter...

CVE-2018-17388

SQL Injection exists in Twilio WEB To Fax Machine System 1.0 via the email or password parameter to logincheck.php, or the id parameter to addemail.php or editcontent.php...

FV Flowplayer Video Player <= 7.3.13.727 - Unauthenticated Stored XSS

The vulnerable function is exposed to unauthenticated users over wpajaxnoprivfvwpflowplayeremailsignup ajax hook. It saves anything that user provides in email POST parameter. PoC Send POST request to wp-admin/admin-ajax.php with body content: "[email protected]" The...

Netartmedia Jobs Portal 6.1 - SQL Injection

Exploit Title: Netartmedia Jobs Portal 6.1 - SQL Injection Date: 19.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/jobsportal/ Demo Site: https://www.ittjobs.com/ Version: 6.1 Tested on: Kali Linux CVE: N/A ----- PoC SQLi ----- Request:...

Netartmedia Event Portal 2.0 SQL Injection

Exploit Title: Netartmedia Event Portal 2.0 - 'Email' SQL Injection Date: 19.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/eventportal/ Demo Site: https://www.phpscriptdemos.com/events/ Version: 2.0 Tested on: Kali Linux CVE: N/A Description: Event Portal ...

Netartmedia Event Portal 2.0 - 'Email' SQL Injection

Exploit Title: Netartmedia Event Portal 2.0 - 'Email' SQL Injection Date: 19.03.2019 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.netartmedia.net/eventportal/ Demo Site: https://www.phpscriptdemos.com/events/ Version: 2.0 Tested on: Kali Linux CVE: N/A Description: Event Portal ...

CVE-2018-19469

ArticleCMS through 2017-02-19 has XSS via the /updatepersonalinfomation realname or email parameter...

SeaCMS cross-site scripting vulnerability (CNVD-2019-08330)

SeaCMS Ocean CMS is a professional open source free PHP film and television system. A stored cross-site scripting vulnerability exists in SeaCMS 6.6.4, which can be exploited by an attacker during a password change via the member.php?action=chgpwdsubmit email parameter...

CVE-2018-19350

In SeaCMS v6.6.4, there is stored XSS via the member.php?action=chgpwdsubmit email parameter during a password change, as demonstrated by a data: URL in an OBJECT element...

Microsoft Windows Server ADFS Server-Side Request Forgery Vulnerability

Microsoft Active Directory Federation Services ADFS is an Active Directory Federation Service from Microsoft. The service provides Web Single Sign-On SSO technology, which enables authentication of a user to multiple websites or applications during a single session. A server-side request forgery...

CVE-2018-16794

Microsoft ADFS 4.0 Windows Server 2016 and previous Active Directory Federation Services has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls...

IBM: Reflected XSS and Blind out of band command injection at subdomain dstuid-ww.dst.ibm.com

I found an XSS and Blind OS based injection issue due to the incorrect handling of the characters in THE EMAIL get& post parameters. A injected and a sleep command succesfully executed, the following link works as a PoC that alerts the string in the script: I reproduced the same on Firefox and IE...

MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection

Exploit Title: MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection Date: 2018-05-23 Software https://www.softneta.com/products/meddream-pacs-server/downloads.html Version: MedDreamPACS Premium 6.7.1.1 Exploit Author: Carlos Avila Google Dork: inurl:Pacs/login.php, inurl:pacsone...

Softneta MedDream PACS Server Premium 6.7.1.1 SQL Injection

Exploit Title: MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection Date: 2018-05-23 Software https://www.softneta.com/products/meddream-pacs-server/downloads.html Version: MedDreamPACS Premium 6.7.1.1 Exploit Author: Carlos Avila Google Dork: inurl:Pacs/login.php, inurl:pacsone...

Barracuda Cloud Control 7.1.1.003 Cross Site Scripting

Document Title: =============== Barracuda Cloud Control 7.1.1.003 - Cross Site Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1992 Release Date: ============= 2018-07-17 Vulnerability Laboratory ID VL-ID:...

refer.travelzoo.com XSS vulnerability

Open Bug Bounty ID: OBB-648629 Description| Value ---|--- Affected Website:| refer.travelzoo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Extole Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...