CVE-2018-1000014: Cross-Site Request Forgery (CSRF)

Jenkins Translation Assistance Plugin 1.15 and earlier did not require form submissions to be submitted via POST, resulting in a CSRF vulnerability allowing attackers to override localized strings displayed to all users on the current Jenkins instance if the victim is a Jenkins administrator...

Design/Logic Flaw

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

CVE-2017-12630

In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...

FS Stackoverflow Clone 1.0 SQL Injection

Ver Ayari...

International Islamic University Chittagong: Improper error handler

during the analysis it was found that when we submit the form and try to upload a txt file then it show a error page with internal path disclosure...

Topsites Script 1.0 - Cross-Site Request Forgery PHP Code Injection

Topsites Script 1.0 - Cross-Site Request Forgery PHP Code Injection Meta Tags File Footer File...

Advertiz PHP Script 0.2 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: Advertiz PHP Script 0.2 - Cross-Site Request Forgery Update Admin User&Pass Dork: N/A Date: 06.09.2017 Vendor Homepage: http://www.dijiteol.com/ Software Link:...

CVE-2017-1000033

Wordpress Plugin Vospari Forms version 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user...

CVE-2017-1000033: Improper Neutralization of Input During Web Page Generation

Wordpress Plugin Vospari Forms version 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user...

WonderCMS 2.1.0 - Cross-Site Request Forgery

WonderCMS 2.1.0 - Cross-Site Request Forgery document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and vulernability...

Yelp: ClickJacking in editing business name

SUMMARY: Hope you guys are doing great. I found clickjacking vulnerability while updating business page.One of the endpoints which is vulnerable to clickjacking is https://www.yelp.com/bizattribute?bizid=RIyHYSf3lyJcFb4El9T4tQ . Clickjacking User Interface redress attack, UI redress attack, UI...

FlySpray 1.0-rc4 - Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications Exploit Title: XSRF Stored FlySpray 1.0-rc4 XSS2CSRF add admin account Date: 19/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT : https://www.openoffice.org Version: 1.0-rc4 Tested on: Windows 7 x64 SP1 / Kali Linux Description : A...

Alstrasoft FMyLife Pro 1.02 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications Exploit Title: AlstraSoft FMyLife Pro v1.02 Script - Cross-Site Request Forgery Add Admin Google Dork: N/A Date: 04.02.2017 Vendor Homepage: http://www.alstrasoft.com/ Software Buy: http://www.alstrasoft.com/fmylife-pro.htm Demo:...

ETchat 3.7 - Cross-Site Request Forgery

ETchat 3.7 - Cross-Site Request Forgery Exploit Title: ETchatpersian version CMS Xsrf vulnerability Exploit Author: Hesam Bazvand Contact: https://www.facebook.com/hesam.king73 Software Link: http://dl.20script.ir/script/chat/et-chat-3.7-Persianwww.20script.ir.zip Tested on: Windows 7 / Kali Linu...

PT-2016-7517

Name of the Vulnerable Software and Affected Versions dotCMS version 3.2.1 Description The issue allows an attacker to bypass the captcha check by loading the captcha once, filling it with the correct value, and then reusing this correct value for subsequent forms that have a captcha check...

Maian Weblog 4.0 - Cross-Site Request Forgery (Add New Post)

Maian Weblog 4.0 - Cross-Site Request Forgery Add New Post Exploit Title : Maian Weblog 4.0 - Cross-Site Request Forgery Add New Post Author : Besim Google Dork : - Date : 10/10/2016 Type : webapps Platform : PHP Vendor Homepage : http://www.maianweblog.com Software link :...

Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- input type="hidden...

Simple PHP Blog 0.8.4 Cross Site Request Forgery

that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- inp...

Simple PHP Blog 0.8.4 - Cross-Site Request Forgery (Add Admin)

that will add a new user as administrator. Once exploited, the attacker can login to the admin panel http://localhost/simple/login.php using the username and the password he posted in the form. CSRF PoC Code ============= -- input typ...

Legal Robot: CSRF Issue

Found CSRF Issue in https://www.legalrobot.com/beta/nl/ POST Request : POST /webhooks/beta HTTP/1.1 Host: app.legalrobot.com User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:48.0 Gecko/20100101 Firefox/48.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1...