13018 matches found
WF Cookie Consent <= 1.1.3 - Authenticated Persistent Cross-Site Scripting (XSS)
The WF Cookie Consent WordPress plugin was affected by an Authenticated Persistent Cross-Site Scripting XSS security vulnerability. 1 Access WordPress control panel. 2 Navigate to the 'Pages'. 3 Add a new page and insert the script you wish to inject into the page title. 4 Now navigate to...
Uber: Cleartext password exposure allows access to the desafio5estrelas.com admin panel
Vendor created and managed site desafio5estrelas.com exposes an administrator login password through the javascript source. This site was used by Uber in Portugal to encourage low-rated drivers to raise their ratings.This password allowed remote users access to the administrator panel of the site...
WordPress Plugin File Upload 4.3.3 - Stored Cross-Site Scripting (PoC)
0x01 漏洞概述 Wordpress的插件WordPress File Upload v4.3.3及其以前版本在管理后台存在一处存储型xss漏洞。攻击者可以通过该漏洞执行js脚本，获取管理员cookie。 漏洞名称：WordPress Plugin File Upload 4.3.3 - Stored Cross-Site Scripting PoC 漏洞来源：https://www.exploit-db.com/exploits/44444/ CVE：CVE-2018-9844 影响组件：WordPress Plugin File Upload...
mlenetwork.com Improper Access Control vulnerability
Open Bug Bounty ID: OBB-609500 Description| Value ---|--- Affected Website:| mlenetwork.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| IAC Improper Access Control / CWE-284 CVSSv3 Score:| 6.5...
Cross site scripting
An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...
CVE-2018-10430
An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...
ExpressionEngine: XML Member Proccessing - Local File inclusion Vulnerability
@lawrenceamer discovered a local file inclusion vulnerability that logged in users with access to the control panel and permission to access developer utilities may be able to exploit. @lawrenceamer gave a detailed report with step-by-step instructions for replicating and screen captures of a the...
Interspire Email Marketer < 6.1.6 - Remote Admin Authentication Bypass
''' Exploit Title: Interspire Email Marketer - Remote Admin Authentication Bypass Google Dork: intitle:"Control Panel" + emailmarketer Date: 4-22-18 Exploit Author: devcoinfet Vendor Homepage: www.interspire.com/emailmarketer Software Link: Can't legally provide link but can be found on net...
ExpressionEngine: Import File Converter - local File inclusion
@lawrenceamer discovered a local file inclusion vulnerability that logged in users with access to the control panel and permission to access developer utilities may be able to exploit. @lawrenceamer gave a detailed report with step-by-step instructions for replicating and screen captures of a the...
CyberCentral Summit 2018 in Prague
Almost whole last week I spent in Prague at CyberCentral conference. It was a pretty unique experience for me. I was for the first time at the International conference as a speaker. And not only I presented my report there, but lead the round table on Vulnerability Management and participated in ...
CVE-2018-10250
iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixincategory action, aka a WeChat Classified Management keyword search...
Nextcloud: Bruteforce in admin panel
Hello there, Admin panel of your website https://nextcloud.com/wp-login.php is vulnerable to bruteforce attacks as their is no rate-limiting. Impact Can gain access to admin panel. To fix this, Just add rate limiting...
iScripts UberforX Cross-Site Request Forgery Vulnerability
IScripts UberforX is an open source e-commerce solution from Iscripts USA. The solution has features such as inventory management, payment gateway support, and hole-in-the-ground application support.Admin Panel is one of the admin panels. A cross-site request forgery vulnerability exists in the...
iScripts eSwap cross-site scripting vulnerability (CNVD-2018-07983)
IScripts eSwap is an item trading program from IScripts Inc. that supports the use of virtual currency or direct item exchange. The program supports the use of virtual currencies for trading or direct item exchange.User Panel is one of the user panels. A cross-site scripting vulnerability exists ...
iScripts UberforX Cross-Site Scripting Vulnerability
IScripts UberforX is an open source e-commerce solution from Iscripts USA. The solution has features such as inventory management, payment gateway support, and hole-in-the-ground application support.Admin Panel is one of the admin panels. A cross-site scripting vulnerability exists in the...
Cross site scripting
iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel...
CVE-2018-10137
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
Cross site request forgery (csrf)
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
