Cross site scripting

PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field...

PT-2019-18644 · Php Scripts Mall · Php Scripts Mall Chartered Accountant : Auditor Website

Name of the Vulnerable Software and Affected Versions: PHP Scripts Mall Chartered Accountant : Auditor Website version 2.0.1 Description: The issue concerns a Stored XSS in the Profile Update page. Specifically, the My Name field is vulnerable, allowing for potential exploitation. Recommendations...

CVE-2019-7553

CVE-2019-7553 affects PHP Scripts Mall Chartered Accountant: Auditor Website version 2.0.1, with a Stored XSS in the Profile Update page via the My Name field. Several sources (Red Hat advisory, CNVD, CVE listings, and PT-2019-18644) confirm the vulnerability type as stored XSS and point to the s...

CVE-2019-7553

PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field...

CVE-2019-7553: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field...

FreeSMS 2.1.2 SQL Injection

Exploit Title: FreeSMS 2.1.2 - Authentication Bypass Date: 2019-04-03 Exploit Author: Yilmaz Degirmenci Vendor Homepage: https://freesms.sourceforge.io/ Software Link: https://sourceforge.net/projects/freesms/ Version: v2.1.2 Category: Webapps Tested on: LAMPP for Linux Software Description :...

Tina4 Stack 1.0.3 - Cross-Site Request Forgery (Update Admin)

Exploit Title: Tina4 Stack 1.0.3 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 2018-11-09 Exploit Author: Ihsan Sencan Vendor Homepage: http://tina4.com/ Software Link: https://ayera.dl.sourceforge.net/project/tina4stack/v1.0.3/Release%20V1.0.3.zip Version: 1.0.3 Category: Webapps...

Timber 1.1 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: Timber - Ultimate Freelancer Platform 1.1 - Cross site request forgery Date: 2018-05-24 Exploit Author: L0RD or email protected Vendor Homepage: https://codecanyon.net/item/timber-ultimate-freelancer-platform/14747284?srank=1717...

Timber 1.1 Cross Site Request Forgery

Exploit Title: Timber - Ultimate Freelancer Platform 1.1 - Cross site request forgery Date: 2018-05-24 Exploit Author: L0RD or [email protected] Vendor Homepage: https://codecanyon.net/item/timber-ultimate-freelancer-platform/14747284?srank=1717 Version: 1.1 Tested on: Kali linux...

Model Agency Media House Model Gallery 1.0 - Multiple Vulnerabilities

Model Agency Media House Model Gallery 1.0 - Multiple Vulnerabilities Exploit Title: Model Agency Media House & Model Gallery 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Authentication bypass Date: 2018-05-21 Exploit Author: Borna nematzadeh L0RD or...

CVE-2018-6864

Cross Site Scripting XSS exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter...

CVE-2018-6861

Cross Site Scripting XSS exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter...

Cross site scripting

Cross Site Scripting XSS exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter...

CVE-2018-6861

Cross Site Scripting XSS exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter...

PT-2018-17789

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Multi religion Responsive Matrimonial version 4.7.2 Description A Cross Site Scripting XSS issue exists, allowing for potential code injection via a user profile update parameter. Recommendations For version 4.7.2, update to a...

PT-2018-17786

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Lawyer Search Script version 1.0.2 Description A Cross Site Scripting XSS issue exists, allowing for potential code injection via a profile update parameter. Recommendations For PHP Scripts Mall Lawyer Search Script version...

CVE-2018-6864: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter...

CVE-2018-6861: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter...

Unikrn: [unikrn.com] Profile updated with error":true,"success":false"

Greetings, We noticed that even if the https://unikrn.com/apiv2/user/updateprofile gave an answer that the code is on error , the post is proceeded : PoC : -- curl 'https://unikrn.com/apiv2/user/updateprofile' -XPOST -H 'Referer: https://unikrn.com/profile' -H 'Content-Type: application/json' -H...

Email address is not validated when updating user profile

On the view profile page /secure/ViewProfile.jspa it's possible to update your user profile /secure/EditProfile!default.jspa?username=admin to an invalid email address. See attached screenshots. !Screen Shot 2017-09-28 at 2.49.48 PM.png|thumbnail! !Screen Shot 2017-09-28 at 2.49.58...