Bolt CMS 3.6.6 Cross Site Request Forgery / Code Execution

history.pushState'', '', '/' function exploit var target = "http://127.0.0.1" var boltadminurl = target + "/bolt"; var xhr = new XMLHttpRequest; xhr.open"POST", boltadminurl + "/upload", true; xhr.setRequestHeader"Accept", "application/json, text/javascript, /; q=0.01";...

SaLICru -SLC-20-cube3(5) - HTML Injection

SaLICru -SLC-20-cube35 - HTML Injection Exploit Title: Reflected HTML Injection Google Dork: None Date: 16/12/2015 Exploit Author: Ramikan Vendor Homepage:https://www.salicru.com/en/ Software Link: N/A Version: Tested on SaLICru -SLC-20-cube35. Firmware: cs121-SNMP v4.54.82.130611 CVE :...

SaLICru -SLC-20-cube3(5) - HTML Injection

Exploit Title: Reflected HTML Injection Google Dork: None Date: 16/12/2015 Exploit Author: Ramikan Vendor Homepage:https://www.salicru.com/en/ Software Link: N/A Version: Tested on SaLICru -SLC-20-cube35. Firmware: cs121-SNMP v4.54.82.130611 CVE : CVE-2019-10887 Category:Web Apps Vulnerability:...

Design/Logic Flaw

A reflected HTML injection vulnerability on Salicru SLC-20-cube35 devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmLog.csv?log= or /waitlog.cgi?name= or /chart.shtml?data= or /createlog.cgi?name=...

CVE-2019-10887

A reflected HTML injection vulnerability on Salicru SLC-20-cube35 devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmLog.csv?log= or /waitlog.cgi?name= or /chart.shtml?data= or /createlog.cgi?name=...

CVE-2019-10887

A reflected HTML injection vulnerability on Salicru SLC-20-cube35 devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmLog.csv?log= or /waitlog.cgi?name= or /chart.shtml?data= or /createlog.cgi?name=...

CVE-2019-10887

CVE-2019-10887 describes a reflected HTML-injection vulnerability in Salicru SLC-20‑cube3(5) devices running firmware cs121-SNMP v4.54.82.130611. Affected endpoints allow HTML payloads via /DataLog.csv?log=, /AlarmLog.csv?log=, /waitlog.cgi?name=, /chart.shtml?data=, and /createlog.cgi?name=. Pub...

SaLICru -SLC-20-cube3(5) HTML Injection

Exploit Title: Reflected HTML Injection Google Dork: None Date: 16/12/2015 Exploit Author: Ramikan Vendor Homepage:https://www.salicru.com/en/ Software Link: N/A Version: Tested on SaLICru -SLC-20-cube35. Firmware: cs121-SNMP v4.54.82.130611 CVE : CVE-2019-10887 Category:Web Apps Vulnerability:...

CVE-2019-10887: Improper Neutralization of Input During Web Page Generation

A reflected HTML injection vulnerability on Salicru SLC-20-cube35 devices running firmware version cs121-SNMP v4.54.82.130611 allows remote attackers to inject arbitrary HTML elements via a /DataLog.csv?log= or /AlarmLog.csv?log= or /waitlog.cgi?name= or /chart.shtml?data= or /createlog.cgi?name=...

PT-2019-12079 · Salicru · Slc-20-Cube3

Name of the Vulnerable Software and Affected Versions: Salicru SLC-20-cube35 devices running firmware version cs121-SNMP v4.54.82.130611 Description: A reflected HTML injection issue allows remote attackers to inject arbitrary HTML elements via specific API endpoints, including /DataLog.csv?log=,...

Hardcoded credentials

AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features...

CVE-2015-5462

AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features...

CVE-2015-5462

AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features...

CVE-2015-5462

CVE-2015-5462 affects AxiomSL’s Axiom Google Web Toolkit module (versions 9.5.3 and earlier). The root cause is an HTML injection vulnerability in the scoping dashboard features, allowing remote attackers to inject HTML. The issue is exploitable over the network without authentication (per CVSS v...

CVE-2015-5462: Improper Neutralization of Special Elements in Output Used by a Downstream Component

AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier allows remote attackers to inject HTML into the scoping dashboard features...

Online school system suffers from xss vulnerability (CNVD-2019-12776)

Online School System is an online education platform developed by Beijing IncuTime Technology Co. An xss vulnerability exists in the I want to ask a question section of the system, which can be exploited by attackers to inject arbitrary Web script or HTML...

JioFi 4G M2S 1.0.2 - Cross-Site Request Forgery

JioFi 4G M2S 1.0.2 - Cross-Site Request Forgery Exploit Title: JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings aka a SetWiFiSetting request to cgi-bin/qcmapwebcgi Exploit Author: Vikas Chaudhary Date: 21-01-2019 Vendor Homepage:...

Cross site scripting

A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/NewGUI/Acl.asp" is request...

CVE-2018-17989

CVE-2018-17989 affects D-Link DSL-3782 devices (firmware 1.01). A stored XSS vulnerability exists in the device’s web interface, allowing an authenticated attacker to inject a JavaScript/HTML payload into the ACL page. The payload executes when the browser requests "/cgi-bin/New_GUI/Acl.asp". Acc...

Cross site scripting

Cross-site scripting XSS vulnerability in SYNO.Core.PersonalNotification.Event in Synology DiskStation Manager DSM before 6.1.4-15217-3 allows remote authenticated users to inject arbitrary web script or HTML via the package parameter...