Bludit 跨站脚本漏洞

A cross-site scripting vulnerability exists in Bludit, an open source lightweight blog content management system CMS, which stems from a tag section in the product's login panel that does not validate input data. An attacker could execute client-side code through this vulnerability...

Sourcecodester Vehicle Service Management System 跨站脚本漏洞

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple Web application for automotive repair/service stores or businesses. Sourcecodester Vehicle Service Management System version 1.0 has a cross-site scripting vulnerability that stems from the vulnerability stem...

Bludit 跨站脚本漏洞

Bludit is an open source lightweight blog content management system CMS. cross-site scripting vulnerability exists in Bludit 3.13.1 and prior versions, which stems from a lack of effective filtering and escaping in the About plugin of the software's login panel, leading to a stored cross-site...

Sourcecodester Vehicle Service Management System 跨站脚本漏洞

Sourcecodester Vehicle Service Management System is an open source PHP project. Sourcecodester Vehicle Service Management System version 1.0 contains a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping in the user list section of the software's login...

Sourcecodester Vehicle Service Management System 跨站脚本漏洞

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple Web application for automotive repair/service stores or businesses. sourcecodester Vehicle Service Management System version 1.0 has a cross-site scripting vulnerability that stems from a lack of effective...

Sourcecodester Vehicle Service Management System 跨站脚本漏洞

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple Web application for automotive repair/service stores or businesses. sourcecodester Vehicle Service Management System version 1.0 has a cross-site scripting vulnerability that stems from a lack of valid...

CVE-2019-5640

Rapid7 Nexpose versions prior to 6.6.114 suffer from an information exposure issue whereby, when the user's session has ended due to inactivity, an attacker can use the inspect element browser feature to remove the login panel and view the details available in the last webpage visited by previous...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

CVE-2021-33256

A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. The jusername parameter seems to be vulnerable and a reverse shell could be obtained if a privileged user exports "User Attempts Audit Repor...

CVE-2021-33256

CVE-2021-33256 affects ManageEngine ADSelfService Plus 6.1 Build 6101. Multiple sources describe a CSV injection on the login panel, where the unauthenticated user can trigger a vulnerability via the j_username parameter, potentially enabling a reverse shell when a privileged user exports the Use...

PT-2021-20095 · Manageengine · Zoho Manageengine Adselfservice Plus

Name of the Vulnerable Software and Affected Versions: ManageEngine ADSelfService Plus version 6.1 Build No: 6101 Description: A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus can be exploited by an unauthenticated user. The j username parameter seems to be...

4Images 1.8 Cross Site Scripting

Exploit Title: 4Images 1.8 - 'redirect' Reflected XSS Exploit Author: Piyush Patil Vendor Homepage: https://www.4homepages.de/ Software Link: https://www.4homepages.de/?download=4images1.8.zip&code=81da0c7b5208e172ea83d879634f51d6 Version: 4Images Gallery 1.8 Tested on: Windows 10 and Kali CVE :...

Seo Panel 4.8.0 - (search_name) Reflected XSS Vulnerability

Exploit Title: Seo Panel 4.8.0 - 'searchname' Reflected XSS Exploit Author: Piyush Patil Vendor Homepage: https://www.seopanel.org/ Software Link: https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0 Version: Seo Panel 4.8.0 Tested on: Windows 10 and Kali CVE : CVE-2021-28417 -Description: A...

ExpressVPN VPN Router 1.0 - Router Login Panels Integer Overflow Vulnerability

Exploit Title: ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow Exploit Author: Jai Kumar Sharma Vendor Homepage: https://www.expressvpn.com/ Software Link: https://www.expressvpn.com/vpn-software/vpn-router Version: version 1 Tested on: Windows/Ubuntu/MacOS CVE : CVE-2020-29238...

CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

CVE-2021-27308

A cross-site scripting XSS vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter...

CVE-2021-27308

CVE-2021-27308 concerns 4images v1.8 with a cross-site scripting (XSS) in the admin login panel, exploitable via the redirect parameter. The underlying issue is insufficient input handling on the redirect field, allowing an attacker to inject JavaScript. Documents also reference public exploits/e...