CMS Papoo 6.0.0 Revision 4701 Cross Site Scripting

Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6 Advisory ID: SROEADV-2014-01 Author: Steffen Rösemann Affected Software: CMS Papoo Version 6.0.0 Rev. 4701 Vendor URL: http://www.papoo.de/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability Description:...

Humhub 0.10.0-rc.1 Cross Site Scripting / SQL Injection

Humhub 1 SQL injection vulnerability + Discovered by: Jos Wetzels, Emiel Florijn + Affects: Humhub condition is injected with the otherwise unsanitized $lastEntryId, which can be any SQL injection. Proof of Concept: Performing the following request index.php?r=notification/list/index&from=999 AND...

Altitude uAgent - Altitude uCI 7.5 XSS

Altitude uAgent - Altitude uCI 7.5 Persistent XSS Details ======================================================================================== Product: Altitude uAgent - Altitude uCI 7.5 Security-Risk: High Vendor-URL: http://www.altitude.com CVE-ID:CVE-2014-9212 Credits...

CSRF and XSS vulnerabilities in D-Link DAP-1360

Hello 3APA3A! There are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model with other...

FlatNuke 3.1.x Cross Site Scripting

------------------------------------------------------------------------- + FlatNuke alertdocument.cookie&body=This is my comment ------------------------------------------------------------------------------------------------...

FlatNuke 3.1.4 (FlatPoll) Persistent XSS Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------- + FlatNuke alertdocument.cookie&body=This is my comment ------------------------------------------------------------------------------------------------ 0day.today...

Folder Plus 2.5.1 iOS - Persistent XSS Vulnerability

No description provided by source. Document Title: =============== Folder Plus v2.5.1 iOS - Persistent Item Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1348 Release Date: ============= 2014-10-24 Vulnerability Laboratory ID VL-ID:...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2 November , 2014 Vulnerability Type:...

Clockingit.com Cross Site Scripting

Affected software: clockingit.com Type of vulnerability: persistent xss URL: clockingit.com Discovered by: Provensec Website: http://www.provensec.com Description: peristet xss issue Proof of concept victim can be exploited by just sending the link to the victim To execute this vector goto regist...

vBulletin 5.x / 4.x Persistent Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API post-auth ============================================================================ ==================== Overview - -------- date : 10/12/2014 cvss : 4.6...

GetSimple CMS 3.3.1 - Cross-Site Scripting

PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1 CVE-2014-1603 by Pedro Ribeiro [email protected] from Agile Information Security Disclosure: 12/05/2014 / Last updated: 12/10/2014 Timeline: 04/11/2013 - Found bugs, produced proof of concept. 05/11/2013 - Communicated to the developer,...

WordPress All In One WP Firewall Plugin 3.8.3 - Persistent XSS

WordPress All In One WP Firewall plugin is prone to a persistent XSS vulnerability. It results session hijacking, persistent external redirect to malicious sources, persistent phishing attacks and application-side manipulation of affected module context. Solution Update the plugin...

Epicor Enterprise 7.4 - Multiple Vulnerabilities

Epicor suffers from cross site scripting and password disclosure vulnerabilities. "Epicor Enterprise vulnerabilities" - Affected vendor: Epicor Software Corporation - Affected system: Epicor Enterprise - Version 7.4 - Vendor disclosure date: May 13th, 2014 - Public disclosure date: September 30th...

insight.ly Cross Site Scripting

Author:Provensec Vendor: insight.ly Vulnerability Type:persistent xss Discription: Integrated online customer relationship management CRM and project management makes sure you are on top of critical business processes. Exploit: 1 Goto add contacts 2 Fill the work address field with xss payload...

phpMyFAQ 2.8.X - Multiple Vulnerabilities

No description provided by source. Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specific user...

osCommerce 2.3.4 - Multiple vulnerabilities

No description provided by source. Title: osCommerce 2.3.4 - Multiple vulnerabilities Date: 10.07.14 Affected versions: = 2.3.4 latest atm Vendor: oscommerce.com Tested on: Apache 2.2.22 at Debian Contact: smash at devilteam.pl Cross Site Scripting 1. Reflected XSS - Send Email Vulnerable...

Atmail Webmail 7.2 - Multiple Vulnerabilities

No description provided by source. Title: Atmail Webmail =7.2 - Multiple XSS & FPD Date: 01.27.2014 Vendor: atmail.com Version: =7.2 Latest ATM, tested also on 7.1.1 Authors: Smash & Brag / smashatdevilteam.pl PoC: poczta.pl / demo.atmail.com 1. Cross Site Scripting a GET - viewmessageTabNumber...

Zen Cart 1.5.3 - Multiple Vulnerabilities

No description provided by source. Title: Zen Cart 1.5.3 - CSRF & Admin Panel XSS Date: 09.07.14 Vendor: zen-cart.com Tested on: Apache 2.2 at Linux Contact: smashatdevilteam.pl 1 - CSRF - Delete admin GET profile stands for user id...

TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities

No description provided by source. Title: TP-LINK Model No. TL-WR841N / TL-WR841ND - Multiple Vulnerabilities Date: 30.06.14 Vendor: TP-LINK Affected versions: TL-WR841N / TL-WR841ND Tested on: Firmware Version - 3.13.27 Build 121101 Rel.38183n, Hardware Version - WR841N v8 00000000 at Linux...

Discuz! 7.2 某自带功能存在储存型XSS漏洞

简要描述： Discuz! 7.2 某自带功能存在储存型XSS漏洞 详细说明： 还是在签到哦 plugin.php?id=dpssign:sign 发表签到 签到可以写入xss 但是要干扰前面的代码 才可以形成xss https://images.seebug.org/upload/201409/1100522754a8ee564ad50b51a9dcd8669c53e051.jpg https://images.seebug.org/upload/201409/1100524583a5fba1a426878f1f3598aaf1fa7dfc.jpg 漏洞证明：...