CVE-2018-19922

Persistent Cross-Site Scripting XSS in the advancedsetupwebsiteblocking.html Website Blocking page of the Actiontec C1000A router with firmware through CAC004-31.30L.95 allows a remote attacker to inject arbitrary HTML into the Website Blocking page by inserting arbitrary HTML into the 'TodUrlAdd...

CVE-2018-19922

The CVE-2018-19922 entry describes a Persistent Cross-Site Scripting (XSS) in the Actiontec C1000A router: the advancedsetup_websiteblocking.html Website Blocking page is vulnerable due to improper handling of the TodUrlAdd parameter in a /urlfilter.cmd POST request. This allows a remote attacker...

CVE-2018-19919

Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php datatitle parameter, as demonstrated by a crafted onload attribute of an SVG element...

CVE-2018-19919

Pixelimity 1.0 is affected by CVE-2018-19919: a persistent XSS flaw in the admin/portfolio.php data[title] parameter, demonstrated by a crafted onload attribute in an SVG element. This indicates that enabling arbitrary HTML/JS injection could occur through the title field when rendering the admin...

Design/Logic Flaw

Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php datatitle parameter, as demonstrated by a crafted onload attribute of an SVG element...

CVE-2018-19919

Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php datatitle parameter, as demonstrated by a crafted onload attribute of an SVG element...

FreeBSD : Gitlab -- Multiple vulnerabilities (8a4aba2d-f33e-11e8-9416-001b217b3468)

Gitlab reports : View Names of Private Groups Persistent XSS in Environments SSRF in Prometheus integration Unauthorized Promotion of Milestones Exposure of Confidential Issue Title Persisent XSS in Markdown Fields via Mermaid Script Persistent XSS in Markdown Fields via Unrecognized HTML Tags...

Gitlab -- Multiple vulnerabilities

Gitlab reports: View Names of Private Groups Persistent XSS in Environments SSRF in Prometheus integration Unauthorized Promotion of Milestones Exposure of Confidential Issue Title Persisent XSS in Markdown Fields via Mermaid Script Persistent XSS in Markdown Fields via Unrecognized HTML Tags...

CVE-2018-17256

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

CVE-2018-17256

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...

Gitlab -- Multiple vulnerabilities

Gitlab reports: Persistent XSS Autocompletion Unauthorized service template creation...

Cross site scripting

Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php...

CVE-2018-19080

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS...

Cross site scripting

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS...

CVE-2018-6906

A persistent Cross Site Scripting XSS vulnerability in the Green Electronics RainMachine Mini-8 2nd Generation and Touch HD 12 web application allows an attacker to inject arbitrary JavaScript via the REST API...

CVE-2018-18868

No-CMS 1.1.3 is prone to Persistent XSS via a contactus name parameter, as demonstrated by the VG48Z5PqVWname parameter...

CVE-2018-18868

No-CMS 1.1.3 is prone to Persistent XSS via a contactus name parameter, as demonstrated by the VG48Z5PqVWname parameter...

CVE-2018-18868

No-CMS 1.1.3 is prone to Persistent XSS via a contactus name parameter, as demonstrated by the VG48Z5PqVWname parameter...

CVE-2018-18868

No-CMS 1.1.3 is affected by CVE-2018-18868: a Persistent XSS vulnerability via the contact_us name parameter. Affected component/entry is the input handling for the contact_us form; the underlying cause is improper input handling that allows script content to be stored/executed in the user’s brow...

MyBB Downloads 2.0.3 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB Downloads 2.0.3 - SQL Injection Exploit Author: Lucian Ioan Nitescu Contact: https://twitter.com/LucianNitescu Webiste: https://nitesculucian.github.io Vendor Homepage: https://github.com/vintagedaddyo/MyBBPlugin-Downloads...