Cross site scripting

A stored cross-site scripting XSS vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pages.php?action=addnew...

CVE-2022-28589: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in Pixelimity 1.0 allows attackers to execute arbitrary web scripts or HTML via the Title field in admin/pages.php?action=addnew...

PT-2022-19095

Name of the Vulnerable Software and Affected Versions Pixelimity version 1.0 Description A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via the Title field in the "admin/pages.php?action=add new" endpoint. This enables attackers to inject malicio...

PT-2022-18771

Name of the Vulnerable Software and Affected Versions AtomCMS version 2.0 Description The issue is related to SQL Injection via the Atom.CMS admin ajax pages.php file. Recommendations For AtomCMS version 2.0, consider restricting access to the Atom.CMS admin ajax pages.php file until a patch is...

PT-2019-7791

Name of the Vulnerable Software and Affected Versions ocim-mp3 plugin versions prior to 2016-03-07 Description The issue concerns a problem with the ocim-mp3 plugin for WordPress, where the id parameter in the /wp-content/plugins/ocim-mp3/source/pages.php endpoint is vulnerable to XSS attacks...

CVE-2016-10998: Improper Neutralization of Input During Web Page Generation

The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS...

CVE-2019-12566

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user...

CVE-2019-12566

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user...

CVE-2019-12566: Improper Neutralization of Input During Web Page Generation

The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript, to attack an admin user...

PT-2019-12856

Name of the Vulnerable Software and Affected Versions WP Statistics plugin versions prior to 12.6.6 Description The issue is related to stored XSS in the includes/class-wp-statistics-pages.php file. It can be exploited when an account with the Editor role creates a post with a title containing...

Listing Hub CMS 1.0 - pages.php id SQL Injection

Listing Hub CMS 1.0 - pages.php id SQL Injection Exploit Title: Listing Hub CMS 1.0 - 'pages.php id' SQL Injection Google Dork: inurl:"pages.php?title=privacy-policy" Date: 14 Feb 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me Vendor Homepage:...

CVE-2018-17835

An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI...

CVE-2018-17835

GetSimple CMS 3.3.15 is affected by CVE-2018-17835. The issue is a stored XSS: an administrator can inject malicious payload via the admin/settings.php Custom Permalink Structure parameter, which then contaminates any page created at the admin/pages.php URI. The vulnerability is rooted in imprope...

PT-2018-14213

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.15 Description An issue allows an administrator to insert stored XSS via the Custom Permalink Structure parameter at the "admin/settings.php" endpoint, which injects the XSS payload into any page created at the...

CVE-2018-17835: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI...

kandilchandeliers.com XSS vulnerability

Open Bug Bounty ID: OBB-553391 Description| Value ---|--- Affected Website:| kandilchandeliers.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Sql injection

FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php florig or fldest parameter...

CVE-2017-17570

FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php florig or fldest parameter...

CVE-2017-17570

FS Expedia Clone 1.0 has SQL Injection via the pages.php or content.php id parameter, or the show-flight-result.php florig or fldest parameter...

CVE-2017-17570

FS Expedia Clone 1.0 is affected by a SQL injection vulnerability in input parameters to pages.php (id), content.php (id) and show-flight-result.php (fl_orig, fl_dest). The issue stems from unsanitized user input in SQL queries, enabling remote attackers to inject commands. Public reports (Exploi...