Microweber 1.0.3 - Persistent Cross-Site Scripting / Cross-Site Request Forgery (Add Admin)

Microweber v1.0.3 Stored XSS And CSRF Add Admin Exploit input type="hidden" name="id" value="0" /...

phpVibe < 4.20 - Persistent Cross-Site Scripting

phpVibe The vulnerability exists because the user input is not properly sanitized and this can lead to malicious code injection that will be executed on the target’s browser -- Proof of Concept -- 1. The attacker posts a new comment which contains our payload: " 2. The stored XSS can be triggered...

WordPress Plugin Ultimate Product Catalogue 3.1.2 - Multiple Persistent Cross-Site Scripting / Cross-Site Request Forgery / Arbitrary File Upload Vulnerabilities

Exploit Title: Multiple Persistent XSS & CSRF & File Upload on Ultimate Product Catalogue 3.1.2 Google Dork: inurl:"SingleProduct" intext:"Back to catalogue" intext:"Category", inurl:"/wp-content/plugins/ultimate-product-catalogue/product-sheets/" Date: 22/04/2015 Exploit Author: Felipe Molina de...

WordPress 4.2 - Persistent Cross-Site Scripting

WordPress 4.2 - Persistent Cross-Site Scripting Source: http://klikki.fi/adv/wordpress2.html Overview Current versions of WordPress are vulnerable to a stored XSS. An unauthenticated attacker can inject JavaScript in WordPress comments. The script is triggered when the comment is viewed. If...

Mapbox: Persistent cross-site scripting (XSS) in map attribution

Hello, I have found a Persistent Cross Site Scripting vulnerability when using a custom style uploaded by myself. Mapbox Studio allows create and upload styles for your maps. So if we create a new style with javascript code as attribution value it will be executed when loading a map that uses our...

Palo Alto Traps Server 3.1.2.1546 - Persistent Cross-Site Scripting

Palo Alto Traps Server 3.1.2.1546 - Persistent Cross-Site Scripting !/usr/bin/ruby =begin ------------------------------------------------------------------------ Product: Palo Alto Traps Server formerly Cyvera Endpoint Protection Vendor: Palo Alto Networks Vulnerable Versions: 3.1.2.1546 Tested...

Social Microblogging PRO 1.5 - Persistent Cross-Site Scripting

Social Microblogging PRO 1.5 - Persistent Cross-Site Scripting Exploit Title: Social Microblogging PRO 1.5 Stored XSS Vulnerability Date: 29-12-2014 Exploit Author: Halil Dalabasmaz Version: v1.5 Vendor Homepage: http://codecanyon.net/item/social-microblogging-pro/9217005 Tested on: Chrome &...

CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting

Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6 Advisory ID: SROEADV-2014-01 Author: Steffen Rösemann Affected Software: CMS Papoo Version 6.0.0 Rev. 4701 Vendor URL: http://www.papoo.de/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability Description:...

CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting

CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6 Advisory ID: SROEADV-2014-01 Author: Steffen Rösemann Affected Software: CMS Papoo Version 6.0.0 Rev. 4701 Vendor URL: http://www.papoo.de/ Vendor Status: fixed CVE-ID: -...

Crea8Social 1.3 - Persistent Cross-Site Scripting

Exploit Title: crea8social 1.3 Stored XSS Vulnerability Date: 24-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.3 Vendor Homepage: http://codecanyon.net/item/crea8social-php-social-networking-platform-v13/9211270 Tested on: Chrome & Iceweasel Vulnerability Description: ===Stored XSS=== Crea...

PHPFox - Persistent Cross-Site Scripting

Exploit Title: PHPFox XSS AdminCP Date: 2014-10-22 Exploit Author: Wesley Henrique Leite aka "spyk2r" Vendor Homepage: http://www.moxi9.com Version: All version CVE : CVE-2014-8469 Response Vendor: fixed 2014-10-23 to v4 Beta + DESCRIPTION The system stores all urls accessed in a database table,...

PHPFox - Persistent Cross-Site Scripting

PHPFox - Persistent Cross-Site Scripting Exploit Title: PHPFox XSS AdminCP Date: 2014-10-22 Exploit Author: Wesley Henrique Leite aka "spyk2r" Vendor Homepage: http://www.moxi9.com Version: All version CVE : CVE-2014-8469 Response Vendor: fixed 2014-10-23 to v4 Beta + DESCRIPTION The system store...

Mouse Media Script 1.6 - Persistent Cross-Site Scripting

Exploit Title: Mouse Media Script Stored XSS Vulnerability Google Dork: "is your best source of fun." inurl:/view/popular Date: 04-10-2014 Exploit Author: Halil Dalabasmaz Version: v1.6 Software Link: http://codecanyon.net/item/mouse-media-script/7773254 Software Test Link: http://media.nisgeo.co...

SEC Consult SA-20141029-1 :: Persistent cross site scripting in Confluence RefinedWiki Original Theme

SEC Consult Vulnerability Lab Security Advisory 20141029-1 ======================================================================= title: Persistent cross site scripting product: Confluence RefinedWiki Original Theme vulnerable version: 3.x - 4.0.x fixed version: 4.0.12 impact: high homepage:...

ZTE Modem ZXDSL 531BIIV7.3.0f_D09_IN - Persistent Cross-Site Scripting

ZTE Modem ZXDSL 531BIIV7.3.0fD09IN - Persistent Cross-Site Scripting Exploit Title: ZTE Modem Stored XSS Vulnerability Date: 30-10-2014 Exploit Author: Ravi Rajput aka Gr3y n00b IHT team Version: ZXDSL 531BIIV7.3.0fD09IN Software Link:http://wwwen.zte.com.cn Tested on : Windows 7 code : GET...

vBulletin 4.x5.x - AdminCPApiLog via xmlrpc API (Authenticated) Persistent Cross-Site Scripting

vBulletin 4.x5.x - AdminCPApiLog via xmlrpc API Authenticated Persistent Cross-Site Scripting CVE-2014-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API post-auth ================================================================================================ Overview...

Livefyre LiveComments Plugin - Persistent Cross-Site Scripting

Title : Stored XSS in Livefyre LiveComments Plugin CVE : 2014-6420 Vendor Homepage : http://livefyre.com Software Link : http://web.livefyre.com/streamhub/liveComments Version : v3.0 Author : Brij Kishore Mishra Date : 03-Sept-2014 Tested On : Chrome 37, Ubuntu 14.04 Description : This plugin...

ChatSecure IM 2.2.4 iOS - Persistent Cross-Site Scripting

Document Title: =============== ChatSecure IM v2.2.4 iOS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1317 Release Date: ============= 2014-09-10 Vulnerability Laboratory ID VL-ID: ==================================== 13...

Feng Office Cross Site Scripting

Affected software: Feng Office - URL: http://www.fengoffice.com/web/demo.php Discovered by: Provensec Website: http://www.provensec.com Type of vulnerability: XSS Stored Feng Office is a Collaboration tool that includes a CRM, Communication, Document Management, Tasks, E-mails, Documents, Interna...

Moodle 2.7 - Persistent Cross-Site Scripting

Title: Moodle 2.7 Persistent XSS Vendor: https://moodle.org/ Moodle advisory: https://moodle.org/mod/forum/discuss.php?d=264265 Researched by: Osanda Malith Jayathissa @OsandaMalith E-Mail: osandacatunseen.is Original write-up: http://osandamalith.wordpress.com/2014/07/25/moodle-2-7-persistent-xs...