CVE-2017-15934

Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter...

Cross site scripting

Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter...

CVE-2017-15934

Artica Pandora FMS 7.0 is affected by a stored Cross-Site Scripting vulnerability in the map name parameter. According to CNVD-2017-36182, remote attackers can inject arbitrary script/HTML via the map name, enabling stored XSS. The CVE entry confirms a stored XSS issue but does not provide exploi...

CVE-2017-15934: Improper Neutralization of Input During Web Page Generation

Artica Pandora FMS version 7.0 is vulnerable to stored Cross-Site Scripting in the map name parameter...

Sql injection

SQL injection vulnerability vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to execute arbitrary SQL commands via the groupname parameter to module/admingroup/addmodifygroup.php for insertgroup and updategroup...

CVE-2017-15279

Cross-site scripting XSS vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" aka nodename parameter during the creation of a new page, related to Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs and...

Umbraco CMS Cross-Site Scripting Vulnerability (CNVD-2017-30256)

Umbraco is the leading open source Microsoft ASP.NET CMS. A cross-site scripting vulnerability exists in Umbraco CMS, which allows remote attackers to inject arbitrary web script or HTML via the "page name" parameter during the creation of a new page...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 project name parameter to project.php; the 2 usejs parameter to user.php; the 3 usejs parameter to group.php; the 4...

CVE-2015-2144

Multiple cross-site scripting XSS vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 project name parameter to project.php; the 2 usejs parameter to user.php; the 3 usejs parameter to group.php; the 4...

WSO2 Data Analytics Server Cross-Site Scripting Vulnerability

WSO2 Data Analytics Server is a data analytics server from WSO2, Inc. that provides real-time analysis of data streams, complex event processing, and machine learning. A cross-site scripting vulnerability exists in the carbon/resources/addcollectionajaxprocessor.jsp file in WSO2 Data Analytics...

CVE-2017-14530: Cross-Site Request Forgery (CSRF)

WPAdminUI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences...

Anblik WordPress image-gallery-with-slideshow SQL Injection Vulnerability

Anblik WordPress image-gallery-with-slideshow is a slideshow plugin for WordPress developed by Anblik Web Design India. A SQL injection vulnerability exists in the image-gallery-with-slideshow/adminsetting.php file in Anblik WordPress image-gallery-with-slideshow version 1.5.2. A remote attacker...

CVE-2015-9228: Unrestricted Upload of File with Dangerous Type

In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter, if a file extension is changed from .jpg to .php...

WordPress Participants Database < 1.7.5.10 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Participants Database 1.7.5.10 - XSS Google Dork: inurl:wp-content/plugins/participants-database/ Date: 01-Sep-17 Exploit Author: Benjamin Lim Vendor Homepage: https://xnau.com/ Software Link:...

WordPress Plugin Participants Database < 1.7.5.10 - Cross-Site Scripting

Exploit Title: Wordpress Plugin Participants Database 1.7.5.10 - XSS Google Dork: inurl:wp-content/plugins/participants-database/ Date: 01-Sep-17 Exploit Author: Benjamin Lim Vendor Homepage: https://xnau.com/ Software Link: https://wordpress.org/plugins/participants-database/ Version: 1.7.5.9...

CVE-2017-13778

Fiyo CMS 2.0.7 has XSS in dapur\apps\appconfig\sysconfig.php via the sitename parameter...

Synology DNS Server Directory Traversal Vulnerability

Synology DNS Server is a DNS server solution from Synology. A directory traversal vulnerability exists in SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server versions prior to 2.2.1-3042. A remote attacker can exploit the vulnerability to write arbitrary files with the help of the...

CVE-2017-12074

Directory traversal vulnerability in the SYNO.DNSServer.Zone.MasterZoneConf in Synology DNS Server before 2.2.1-3042 allows remote authenticated attackers to write arbitrary files via the domainname parameter...

Hewlett Packard Enterprise Intelligent Management Center sshConfig Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

Hewlett Packard Enterprise Intelligent Management Center iccSelectDymicParam Expression Language Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...