Flat Calendar 1.1 HTML Injection

!/usr/bin/perl -w Title : Flat Calendar v1.1 HTML Injection Exploit Download : http://www.circulargenius.com/flatcalendar/FlatCalendar-v1.1.zip Author : ZoRLu / [email protected] Website : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Test : Windows7 Ultima...

CVE-2014-3988

CVE-2014-3988 is an XSS vulnerability in SunHater KCFinder 3.11 and earlier, exploitable via the file or directory name of an uploaded file in index.php. The published description states that remote attackers can inject arbitrary web script or HTML. Affected software/versions are explicitly SunHa...

Multiple vulnerabilities in MantisBT

High-Tech Bridge Security Research Lab has discovered multiple vulnerabilities in MantisBT, which can be exploited to perform Cross-Site Scripting XSS and SQL injection attacks. Improper access control vulnerability discloses database's credentials login and password in plaintext. 1 Cross-Site...

CVE-2014-9174

Cross-site scripting XSS vulnerability in the Google Analytics by Yoast google-analytics-for-wordpress plugin before 5.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "Manually enter your UA code" manualuacodefield field in the General Settings...

Cross site scripting

Cross-site scripting XSS vulnerability in the InstaSqueeze Sexy Squeeze Pages plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to lp/index.php...

CVE-2014-7850

Cross-site scripting XSS vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation...

Microsoft IIS 7.5 Cross Site Scripting

Hello everyone, I found some weird HTML code injection in an IIS error message. IIS spits out some part of the user input that generated the error message, but will only display 20 characters at most. My question is: is it possible to actually exploit an XSS with this ? Here is an example: HTTP...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio DZS Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 swfloc or 2 designrand parameter...

CVE-2014-9103

Kunena for Joomla! is affected by CVE-2014-9103: multiple XSS vulnerabilities present in Kunena before version 3.0.6. An attacker can inject arbitrary script/HTML via the index value of an array parameter or the filename parameter in the Content-Disposition header to the file or profile image upl...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Web Experience Factory WEF 6.1.5 through 8.5.0.1, as used in WebSphere Dashboard Framework WDF and Lotus Widget Factory LWF, allows remote attackers to inject arbitrary web script or HTML by leveraging a Dojo builder error in an unspecified WebSphere...

Device42 DCIM Appliance Manager Ping Command Injection Exploit

Device42 DCIM Appliance Manager versions 5.10 and 6.0 with WAN emulator version 2.3 remote command injection exploit for Metasploit that leverages ping. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core'...

CVE-2014-8349

Cross-site scripting XSS vulnerability in Liferay Portal Enterprise Edition EE 6.2 SP8 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the 20body parameter in the comment field in an uploaded file...

CVE-2014-8349

Cross-site scripting XSS vulnerability in Liferay Portal Enterprise Edition EE 6.2 SP8 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the 20body parameter in the comment field in an uploaded file...

RobotStats 1.0 - HTML Injection

Title : RobotStats v1.0 HTML Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstats/ Download :...

RobotStats 1.0 - HTML Injection

RobotStats 1.0 - HTML Injection Title : RobotStats v1.0 HTML Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstat...

RobotStats 1.0 Cross Site Scripting

Title : RobotStats v1.0 HTML Injection Vulnerability Author : ZoRLu / [email protected] / [email protected] Home : http://milw00rm.com / its online Twitter : https://twitter.com/milw00rm or @milw00rm Date : 22.11.2014 Demo : http://alpesoiseaux.free.fr/robotstats/ Download :...

CVE-2014-8539

Cross-site scripting XSS vulnerability in Simple Email Form 1.8.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the modsimpleemailformfield21 parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Quick Stats page psilan.cgi in ZTE ZXDSL 831 and 831CII allows remote attackers to inject arbitrary web script or HTML via the domainname parameter in a save action. NOTE: this issue was SPLIT from CVE-2014-9021 per ADT1 due to different affected...

CVE-2014-9020

CVE-2014-9020 is an XSS vulnerability affecting ZTE ZXDSL 831 and 831CII devices in the Quick Stats page (psilan.cgi). The vulnerability arises from insufficient input validation on the domainname parameter in the save action, allowing remote attackers to inject arbitrary web script or HTML. This...

CVE-2014-9021

Multiple cross-site scripting XSS vulnerabilities in ZTE ZXDSL 831 allow remote attackers to inject arbitrary web script or HTML via the 1 tr69cAcsURL, 2 tr69cAcsUser, 3 tr69cAcsPwd, 4 tr69cConnReqPwd, or 5 tr69cDebugEnable parameter to the TR-069 client page tr69cfg.cgi; the 6 timezone parameter...