CVE-2020-13231

In Cacti before 1.2.11, authprofile.php?action=edit allows CSRF for an admin email change...

Topcoder: Blind stored XSS due to insecure contact form at https://www.topcoder.com leads to leakage of session token and other PII

Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://www.topcoder.com/contact-us/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets...

CVE-2019-20798

An XSS issue was discovered in handlerserverinfo.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and...

Default configuration

An XSS issue was discovered in handlerserverinfo.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2020-32356)

Subrion CMS is a PHP-based content management system CMS from the Subrion team. The system can be integrated into a website and supports a variety of extensions plugins and more. A cross-site scripting vulnerability exists in the /panel/configuration/general settings page in Subrion CMS version...

PT-2020-10768 · Cherokee · Cherokee

Name of the Vulnerable Software and Affected Versions: Cherokee versions 1.2.104 and earlier Description: A cross-site scripting XSS issue was discovered in the handler server info.c file. The requested URL is improperly displayed on the About page in the default configuration of the web server a...

Plesk/myLittleAdmin ViewState .NET Deserialization

This module exploits a ViewState .NET deserialization vulnerability in web-based MS SQL Server management tool myLittleAdmin, for version 3.8 and likely older versions, due to hardcoded parameters in the web.config file for ASP.NET. Popular web hosting control panel Plesk offers myLittleAdmin as ...

Concrete CMS: Stored XSS on express entries

Download Concrete5 8.5.2 and install it 2. Log into your Concrete5 instance as admin 3. Go to Dashboard System settings Express entities /index.php/dashboard/system/express/entities 4. Сlick on the Create button 5. in the field Name paste the following text: alert1 6. Go to tab View Objects...

Anubis Malware Upgrade Logs When Victims Look at Their Screens

The Anubis malware, which threat actors use to persistently attack Google’s Android-based smartphones, is set to evolve once again, this time adding a feature that allows the malware to identify if a victim is looking at his or her screen. The new feature is one of several that haven’t been...

Shopify: Inject page in admin panel via Shopify.API.pushState with protocol invalid

Disclose Token in reports Summary Some time, i found a bug the 662083. Today I found a new payload, invalid protocol are not tested correctly in filter method. Step to Reproduce See the steps in 662083, but with payload of step 02 replace to: javascript function attack const ctx =...

The vulnerability of the WordPress website content management system, related to the lack of measures taken to protect the structure of web pages, allows attackers to compromise the integrity of data.

The vulnerability of the WordPress content management system’s functions is related to an error in the XSS attack reproduction process in the tool panel. Exploiting this vulnerability could allow a remote attacker to compromise data integrity...

Intelbras CIP 92200 Cross-Site Request Forgery Vulnerability

Intelbras CIP 92200 is a VoIP switch from Intelbras Poland. A cross-site request forgery vulnerability exists in the Intelbras CIP 92200 that stems from the program failing to properly validate user input. A remote attacker could use this vulnerability to access the panel and perform capture...

Cross site scripting

In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor with write access as well load the same page into the Markdown editor, the XSS payload will be...

CVE-2020-8830

CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen...

CVE-2020-8829

CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis...

CVE-2020-7983

A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks...

Cross site request forgery (csrf)

CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis...

CVE-2020-8829

CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis...

CVE-2020-8829

CSRF on Intelbras CIP 92200 devices allows an attacker to access the panel and perform scraping or other analysis...

CVE-2020-7983

CVE-2020-7983 affects CommScope Ruckus ZoneFlex R500 devices running 3.4.2.0.384. The vulnerability is a CSRF in login.asp that could allow remote attackers to access the administrative panel and potentially perform SSRF attacks. Affected component is the login page (login.asp); root cause detail...