151 matches found
Use-After-Free
Mozilla Firefox is vulnerable to use-after-free vulnerability. This occurs when manipulating form input elements. An attacker could cause a potentially exploitable crash resulting a denial of service condition...
Bashter - Web Crawler, Scanner, And Analyzer Framework
Bashter is a tool for scanning a Web-based Application. Bashter is very suitable for doing Bug Bounty or Penentration Testing. It is designed like a framework so you can easily add a script for detect vulnerability. For Example You can add something script like this:...
CVE-2019-9016
An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formname parameter in a mod=column request, as demonstrated by the...
Input validation
Plaintext of decrypted emails can leak through by user submitting an embedded form by pressing enter key within a text input field. This vulnerability affects Thunderbird 52.9...
Component AlphaIndex Dictionaries SQL Injection Vulnerability in Joomla!
Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A SQL injection vulnerability exists in the Joomla! component AlphaIndex Dictionaries. The vulnerability is caused by an attacker inserting SQL commands into the query string of a w...
Social Factory SQL Injection Vulnerability in Joomla!
Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A SQL injection vulnerability exists in the Social Factory component of Joomla! The vulnerability is caused by inserting SQL commands into the query string of a web form submission ...
Component Music Collection SQL Injection Vulnerability in Joomla!
Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS. A SQL injection vulnerability exists in the Music Collection component of Joomla! The vulnerability is caused by inserting SQL commands into the query string of a web form submissio...
VulnCheck KEV: CVE-2016-6277
NETGEAR confirmed multiple routers allow unauthenticated web pages to pass form input directly to the command-line interface, permitting remote code execution...
Joomla! Component Zh GoogleMap 8.4.0.0 - SQL Injection
input name="id" value="-11 UNION ALL SELECT...
Mozilla: Use-after-free while manipulating form input elements (MFSA 2018-03)
A use-after-free vulnerability can occur when form input elements, focus, and selections are manipulated by script content. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 52.6, Firefox ESR 52.6, and Firefox 58...
PHPMyWind 5.3 - Cross-Site Scripting
Exploit Title：PHPMyWind 5.3 has XSS Exploit Author:小雨 Vendor Homepage:http://phpmywind.com Software Link:http://phpmywind.com/downloads/PHPMyWind5.3.zip Version:5.3 CVE:CVE-2017-12984 $r= $dosql-GetOne"SELECT Maxorderid AS orderid FROM @message"; $orderid= empty$r'orderid' ? 1 : $r'orderid' + 1;...
Pivotal Spring Web Flow Remote Code Execution Vulnerability
Pivotal Spring Web Flow is a web application from Pivotal Software, Inc. that provides navigation for check-in, loan application or shopping cart checkout. A remote code execution vulnerability exists in Pivotal Spring Web Flow versions 2.4.0 through 2.4.4. The vulnerability is caused due to a...
CVE-2017-5367
Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, which allows a remote attacker to execute malicious scripts within an authenticated client's browser. The URL is /zm/index.php and sample...
PT-2017-16456
Name of the Vulnerable Software and Affected Versions ZoneMinder versions 1.29 through 1.30 Description Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder, an open-source CCTV server web application. This allows a remote attacker to execute malicious...
NUUO NVRmini 2 3.0.8 - Cross-Site Request Forgery (Add Admin)
input type="hidden" name="addusername" value...
Security update for MozillaFirefox, mozilla-nss (important)
Mozilla Firefox was updated to 48.0 to fix security issues, bugs, and deliver various improvements. The following major changes are included: - Process separation e10s is enabled for some users - Add-ons that have not been verified and signed by Mozilla will not load - WebRTC enhancements - The...
python-django-horizon: XSS in client side template
A DOM-based, cross-site scripting vulnerability has been identified in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form for example, using an image's description,...
Getdpd BB #3 - Persistent Cross Site Scripting Vulnerability
Document Title: =============== Getdpd BB 3 - Persistent Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1567 ID: 14771 Release Date: ============= 2016-02-03 Vulnerability Laboratory ID VL-ID:...
Ilya Birman E2 - @actionscomment-process SQL Injection
Ilya Birman E2 - @actionscomment-process SQL Injection source: https://www.securityfocus.com/bid/68843/info Ilya Birman E2 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to compromise the application,...
XGB 1.2 - Remote Form Field Input Validation Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/4515/info xGB is guestbook software. It is written in PHP and will run on most Unix and Linux variants as well as Microsoft Windows operating systems. xGB does not sufficiently validate input that is supplied via form...