Stored XSS viva .webmv file upload

Description The application allows .webmv files to upload which lead to stored XSS Proof of Concept 1.First, open your text file/notepad and paste the below payload and save it as XSS.webmv: alert1337 alertdocument.domain alertdocument.location alert'XSSbySamprit Das' 2.Then go to...

Stored XSS viva .ofd file upload

Description The application allows .ofd files to upload which lead to stored XSS Proof of Concept 1.First, open your text file/notepad and paste the below payload and save it as XSS.ofd: alert1337 alertdocument.domain alertdocument.location alert'XSSbySamprit Das' 2.Then go to...

Stored XSS viva axd and cshtml file upload in star7th/showdoc

Description This is a bypass of the report: https://huntr.dev/bounties/3eb5a8f9-24e3-4eae-a212-070b2fbc237e/ & https://huntr.dev/bounties/6127739d-f4f2-44cd-ae3d-e3ccb7f0d7b5/. Here the upload functionality allows the malicious files with the extension .cshtml and .axd which leads to Stored XSS...

Microweber 代码问题漏洞

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A remote code execution vulnerability exists in versions of microweber prior to 1.2.12, which...

Arbitrary Code Execution

@advanced-rest-client/base is vulnerable to arbitrary code execution. The vulnerability exists in the hasHeaders function of HeadersListElement.js, allowing an attacker to inject and execute malicious scripts through the target link in the response headers, which may lead to gaining access to...

MTN Group: cross site scripting reflected

The vulnerability was a cross-site scripting XSS flaw that allowed arbitrary JavaScript to be executed on the target website. The payload '-alert1-' was reflected in the website's output, demonstrating the presence of the vulnerability...

CVE-2021-4030

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts...

CVE-2021-4030

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts...

CVE-2021-4030

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts...

CVE-2021-4030

CVE-2021-4030 describes a cross-site request forgery in the HTTP daemon of Zyxel ARMOR Z1/Z2 firmware. By tricking a local user into visiting a malicious site, an attacker could coerce the user to execute arbitrary commands on the device via the compromised HTTP daemon. The provided documents con...

Cross-site Scripting (XSS) - Reflected

Description Can escape the meta tag because the user doesn't escape the double-quote in the $redirectUrl parameter when logging out. Proof of Concept txt https:///demo/api/logout?redirectto=/asdf" Impact Through this vulnerability, an attacker is capable to execute malicious scripts...

Cross-site Scripting (XSS)

librenms is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of input via the dashboardname allowing an attacker to inject maliciously crafted scripts into the system...

PT-2022-13284

Name of the Vulnerable Software and Affected Versions librenms/librenms versions prior to 22.1.0 Description The issue is related to Cross-site Scripting XSS - Stored. This type of attack occurs when an application stores user input data without proper validation, allowing an attacker to inject...

Arbitrary Code Execution

vm2 is vulnerable to arbitrary code execution. Remote attackers are able to inject and execute crafted malicious scripts on the host machine via direct access to host error objects generated by node internals during generation of a stacktraces...

PT-2022-13271

Name of the Vulnerable Software and Affected Versions librenms/librenms versions prior to 22.2.0 Description The issue is related to Cross-site Scripting XSS - Stored. This type of attack occurs when an application stores user input and later displays it to other users without proper validation o...

Cross-site Scripting (XSS) - Reflected in orchardcms/orchardcore

Description Reflected XSS is found under DesignShortcodeNew Shortcode Proof of Concept POC Video https://drive.google.com/file/d/1yFfa7g8MMUvJrrKTpJXZEHhQLRSZ1Cii/view?usp=sharing Impact Through this vulnerability, an attacker is capable to execute malicious scripts...

PT-2022-13260

Name of the Vulnerable Software and Affected Versions microweber versions prior to 1.2.11 Description The issue is related to Cross-site Scripting XSS - Stored. This means an attacker can inject malicious scripts into the website, which will be executed by the user's browser. The estimated number...

Cross-site Scripting (XSS)

pimcore/pimcore is vulnerable to cross-site scripting. The vulnerability exists in website.js because it doesn't properly escape the grid values which allows an attacker to send and execute malicious scripts...

PT-2022-13227

Name of the Vulnerable Software and Affected Versions pimcore/pimcore versions prior to 10.3.1 Description The issue is related to Cross-site Scripting XSS - Stored, which allows an attacker to inject malicious scripts into a website. This can lead to unauthorized access to sensitive data or taki...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce services. stored xss vulnerability occurs when you change the value of Abbreviation, Longname, Converter Service at "Settings" = "Data Objects" = "Quantity Value" in the...