InstantCMS 2.16.1 Cross Site Scripting

Exploit Title: InstantCMS - Store XSS Application: InstantCMS Version: v2.16.1 Bugs: Stored XSS Technology: PHP Vendor Homepage: https://instantcms.ru/ Software Link: https://instantcms.ru/get Date: 14.09.2023 Author: SoSPiro Tested on: Windows Description I noticed that you filtered the filter...

CVE-2018-14382

InstantCMS 2.10.1 has /redirect?url= XSS...

Cross site scripting

InstantCMS 2.10.1 has /redirect?url= XSS...

CVE-2018-14382

InstantCMS 2.10.1 has /redirect?url= XSS...

CVE-2018-14382

InstantCMS 2.10.1 has /redirect?url= XSS...

CVE-2018-14382

CVE-2018-14382 affects InstantCMS 2.10.1 with a reflected XSS via the path /redirect?url= . The CVE record notes an injection in this redirect parameter; CVSS v2 base score 4.3 (MEDIUM) and CVSS v3 base score 6.1 (MEDIUM). Exploitation details are not described beyond the vulnerability type in th...

CVE-2018-14382

InstantCMS 2.10.1 has /redirect?url= XSS...

PT-2018-12480

Name of the Vulnerable Software and Affected Versions InstantCMS version 2.10.1 Description The issue concerns an XSS vulnerability. It is related to the "/redirect?url=" endpoint, which is susceptible to cross-site scripting attacks. Recommendations For InstantCMS version 2.10.1, consider...

CVE-2018-14382: Improper Neutralization of Input During Web Page Generation

InstantCMS 2.10.1 has /redirect?url= XSS...

instantcms.ru Open Redirect vulnerability

Vulnerable URL: http://www.instantcms.ru/go/url=http://xssposed.org/ Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 11:53 GMT Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed Alexa Rank| 35958 Google Pagerank| 4 VIP...

InstantCMS 1.10.3 - Blind SQL Injection

No description provided by source...

InstantCMS 1.6 - Remote PHP Code Execution

No description provided by source. require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initializeinfo = superupdateinfoinfo, 'Name' = 'InstantCMS 1.6 Remote PHP Code Execution', 'Description' = %q This module exploits an...

SQL Injection in InstantCMS

Advisory ID: HTB23185 Product: InstantCMS Vendor: InstantSoft Vulnerable Versions: 1.10.3 and probably prior Tested Version: 1.10.3 Advisory Publication: November 20, 2013 without technical details Vendor Notification: November 20, 2013 Vendor Patch: November 21, 2013 Public Disclosure: December...

BF, LE and IAA vulnerabilities in InstantCMS

Hello 3APA3A! As I've announced earlier http://seclists.org/fulldisclosure/2013/Nov/219, I conducted a Day of bugs in WordPress 3. At 30.11.2013 I disclosed many new vulnerabilities in WordPress. I've disclosed 10 holes they were placed at my site for your attention. And this is translation of th...

PT-2014-67: Open Redirect in InstantCMS

The specialists of the Positive Research center have detected an Open Redirect vulnerability in InstantCMS. Open redirect in the set.php script allows remote attackers to control user redirection. This vulnerability can be exploited to conduct a series of attacks against users of the web...

PT-2014-68: Multiple SQL Injection in InstantCMS

The specialists of the Positive Research center have detected multiple SQL Injection vulnerabilities in InstantCMS. SQL Injection in the cms.php script allows remote attackers to execute arbitrary SQL commands via a specially crafted request. How to fix Update your software up to the latest...

PT-2014-66: Cross-Site Scripting in InstantCMS

The specialists of the Positive Research center have detected a Cross-Site Scripting vulnerability in InstantCMS. Cross-site scripting in the frontend.php file allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's browser. How to fi...

PT-2014-65: Multiple Cross-Site Scripting in InstantCMS

The specialists of the Positive Research center have detected multiple Cross-Site Scripting vulnerabilities in InstantCMS. Cross-site scripting in the spellchecker.php file allows remote attackers to inject arbitrary HTML tags including JavaScript scripts, etc. to a page processed by user's...

InstantCMS 1.10.3 - Blind SQL Injection

Exploit for windows platform in category web applications Advisory Details: High-Tech Bridge Security Research Lab discovered blind SQL injection vulnerability in InstantCMS, which can be exploited to perform SQL Injection attacks, alter SQL requests and compromise vulnerable application. 1 SQL...

InstantCMS 1.10.3 - Blind SQL Injection

InstantCMS 1.10.3 - Blind SQL Injection Advisory ID: HTB23185 Product: InstantCMS Vendor: InstantSoft Vulnerable Versions: 1.10.3 and probably prior Tested Version: 1.10.3 Advisory Publication: November 20, 2013 without technical details Vendor Notification: November 20, 2013 Vendor Patch: Novemb...