Cross site scripting

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the index.php?m=feedback&f=index&v=contact URI...

CVE-2018-12540

In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHandler do not assert that the XSRF Cookie matches the returned XSRF header/form parameter. This allows replay attacks with previously issued tokens which are not expired yet...

Open Redirect

Cloud Foundry UAA is vulnerable to open redirect attacks. The vulnerability is possible because it does not check the redirection link on a form parameter after an authenticated user clicks on a link used for internal UAA redirects on the login page, allowing an attacker to create a link to...

Open redirect

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open...

PT-2018-10261

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions later than 4.6.0 and prior to 4.19.0, excluding versions 4.10.1 and 4.7.5 uaa-release versions later than v48 and prior to v60, excluding versions v55.1 and v52.9 Description The issue allows open redirects due to a...

WUZHI CMS 4.1.0 - form[qq_10] Cross-Site Scripting

WUZHI CMS 4.1.0 - formqq10 Cross-Site Scripting Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability Date: 2018-4-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE: CVE-2018-10313 An...

WUZHI CMS Cross-Site Scripting Vulnerability

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in WUZHI CMS version 4.1.0. A remote attacker can inject arbitrary Web script or HTML by sending the parameter...

DEBIAN-CVE-2018-8763

Roland Gruber Softwareentwicklung LDAP Account Manager before 6.3 has XSS via the dn parameter to the templates/3rdParty/pla/htdocs/cmd.php URI or the template parameter to the templates/3rdParty/pla/htdocs/cmd.php?cmd=renameform URI...

CVE-2017-16921

In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters related to PGP and execute arbitrary shell commands with the permissions of the OTRS or web...

DEBIAN-CVE-2017-11107

phpLDAPadmin through 1.2.3 has XSS in htdocs/entrychooser.php via the form, element, rdn, or container parameter...

PYSEC-2017-60

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to 1...

CVE-2017-5990: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PhreeBooksERP before 2017-02-13. The vulnerability exists due to insufficient filtration of user-supplied data in the "form" HTTP GET parameter passed to the "PhreeBooksERP-master/extensions/ShippingMethods/ups/labelmgr/jsinclude.php" and...

RStickets! 1.0.0 Remote Shell Upload

RStickets! RSTickets!" is no longer sold / developed POC: Upload shell.php.zip from the form and the shell will be uploaded to the server on this path components/comrstickets/files/ and it will be executable May be another versions are vulnerable also to the same vulnerability = XSS In name...

CVE-2014-7290

Multiple cross-site scripting XSS vulnerabilities in Atlas Systems Aeon 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 Action or 2 Form parameter to aeon.dll...

CVE-2014-7290: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Atlas Systems Aeon 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 Action or 2 Form parameter to aeon.dll...

PT-2014-7884

Name of the Vulnerable Software and Affected Versions Aeon versions 3.5 through 3.6 Description The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the Action or Form parameter to the "aeon.dll" endpoint. Recommendations For versions 3.5 and 3.6, conside...

CVE-2014-4718

Multiple cross-site request forgery CSRF vulnerabilities in Lunar CMS before 3.3-3 allow remote attackers to hijack the authentication of administrators for requests that 1 add Super users via a request to admin/usercreate.php or conduct cross-site scripting XSS attacks via the 2 email or 3 subje...

Design/Logic Flaw

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service CPU consumption by sending many crafted parameters...

CVE-2008-5729

CVE-2008-5729 describes multiple cross-site scripting (XSS) vulnerabilities in AIST NetCat 3.12 and earlier. The issues allow remote attackers to inject arbitrary web script or HTML via three vectors: (1) the form and (2) the control parameters to FCKeditor/neditor.php, and (3) the path parameter...

PT-2007-5296 · Phphostbot · Phphostbot

Name of the Vulnerable Software and Affected Versions: PhpHostBot affected versions not specified Description: The issue allows remote attackers to execute arbitrary PHP code via a URL in the login form parameter in the library/authorize.php file. Recommendations: At the moment, there is no...