61 matches found
Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS
The plugin does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create a new Grid/Caroussel, in the General Settings, enable "Display Header Title" and put the...
Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS
The plugin does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Create a new Grid/Caroussel, in the General Settings, enable "Display Header Title" and put the following...
Lansweeper lansweeper HelpdeskSetupActions SQL injection vulnerability
Summary A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Tested Versions Lansweeper...
ARForms Form Builder < 1.5 - Admin+ Stored Cross Site Scripting
The plugin does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in the From/Replyto Name field at ARForms Lite General Settings Email Settings: "alert/X...
Client Invoicing by Sprout Invoices < 19.9.7 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in one of the vulnerable fields in the General Settings of the plugin...
Two Way Chat < 3.1.5 - Multiple CSRF
The plugin does not have CSRF checks in place in some of its functions, allowing attacker to make logged in admin perform unwanted actions, such as update the plugin's settings...
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
✍️ Description Stored xss via generalsettings 🕵️♂️ Proof of Concept 1. gotohttps://demo.livehelperchat.com/siteadmin/chatbox/configuration and update a General settings with xss payload xss"'' and save it . 2. now try to edit this Chatbox settings using url like...
Java Security Analysis for IntelliJ IDEA
New Plugin Features In the course of our last releases, we added various new functionalities and improved existing ones to enhance the quality of our IntelliJ plugin. These include support for analyzing Java code, support for multi-module projects, tracking and commenting of issues, and the optio...
Subsonic cross-site scripting vulnerability (CNVD-2018-20097)
Subsonic is a media file hosting platform developed and maintained by software developer Sindre Mehus. A cross-site scripting vulnerability exists in generalSettings in Subsonic version 6.1.1. A remote attacker can exploit this vulnerability by sending the 'title' and 'subtitle' parameters to the...
CVE-2018-14690
An issue was discovered in Subsonic 6.1.1. The general settings are affected by two stored cross-site scripting vulnerabilities in the title and subtitle parameters to generalSettings.view that could be used to steal session information of a victim...
Cross site scripting
An issue was discovered in Subsonic 6.1.1. The general settings are affected by two stored cross-site scripting vulnerabilities in the title and subtitle parameters to generalSettings.view that could be used to steal session information of a victim...
Creatiwity wityCMS Cross-Site Scripting Vulnerability
Creatiwity wityCMS is a lightweight PHP-based model-view-controller-oriented content management system CMS. A cross-site scripting vulnerability exists in the 'Website's name' field on the 'Settings' page under the 'General' menu in version 0.6.1 of Creatiwity wityCMS. ' field in the 'Settings'...
CVE-2018-11512
Stored cross-site scripting XSS vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to...
Cross site scripting
Cross-site scripting XSS vulnerability in CMS Made Simple CMSMS 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage sitesetting General Settings globalmetadata" field...
CVE-2017-6556
Cross-site scripting XSS vulnerability in CMS Made Simple CMSMS 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the "adminpage sitesetting General Settings globalmetadata" field...
CVE-2017-6556
CMS Made Simple (CMSMS) 2.1.6 is affected by a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary script/HTML via the adminpage > sitesetting > General Settings > globalmetadata field. The issue stems from inadequate input validation in th...
Hindu Matrimonial Script - Authentication Bypass Vulnerability
Exploit for php platform in category web applications Vulnerability:: Admin Login Bypass & SQLi + Add/Edit Date: 13.01.2017 Vendor Homepage: http://www.phpmatrimonialscript.in/ Script Name: Hindu Matrimonial Script Script Buy Now: http://www.phpmatrimonialscript.in/product/hindu-matrimonial-scrip...
Hindu Matrimonial Script - Authentication Bypass
Hindu Matrimonial Script - Authentication Bypass Vulnerability:: Admin Login Bypass & SQLi + Add/Edit Date: 13.01.2017 Vendor Homepage: http://www.phpmatrimonialscript.in/ Script Name: Hindu Matrimonial Script Script Buy Now: http://www.phpmatrimonialscript.in/product/hindu-matrimonial-script/...
CVE-2014-9174
The CVE-2014-9174 entry corresponds to a Cross-site scripting (XSS) vulnerability in the WordPress plugin Google Analytics by Yoast (google-analytics-for-wordpress) prior to version 5.1.3. The issue arises from unsafely handling the value entered in the General Settings field “Manually enter your...
