WordPress Neuvoo-Jobroll 2.0 Cross Site Scripting

Exploit Title: Wordpress plugin neuvoo-jobroll 2.0 Reflected Cross-Site Scripting RXSS Date: 05/11/2015 Author: Mickael Dorigny @ Synetis Vendor or Software Link: http://neuvoo.fr/fr Version: 2.0 Category: Reflected Cross Site Scripting Google dork: Tested on : Wordpress with neuvoo-jobroll 2.0...

methodOverride Middleware Reflected Cross-Site Scripting

Overview Connect is a stack of middleware that is executed in order in each request. The "methodOverride" middleware allows the http post to override the method of the request with the value of the "method" post key or with the header "x-http-method-override". Because the user post input was not...

WordPress PDF And Print Plugin <= 1.7.4 - Reflected Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Vulnerable parameter is "bwslicensekey". Solution Upgrade this plugin...

Mango Automation 2.6.0 Remote XSS POST Injection Vulnerability

Summary Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Description The application is prone to a...

WP Symposium <= 15.8.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The wp-symposium WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/wp-symposium/getalbumitem.php?size=...

WordPress Social Locker Plugin <= 4.2.0 - Reflected Cross Site Scripting

Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Update the plugin...

[SYSS-2015-041] XSS in OpenText Secure MFT

Advisory ID: SYSS-2015-041 Product: Secure MFT Vendor: OpenText Affected Versions: 2013 R1, 2014 R1, 2014 R2 Tested Versions: 2014 R2 SP4 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Vendor Notification: 2015-08-05 Solution Date: 2015-08-14 Public...

Pornhub: [reflected xss, pornhub.com] /blog, any

The researcher identified that the following URL for the Pornhub blog was vulnerable to reflected/semi-stored cross site scripting, which enabled the researcher to craft a URL that pops multiple alert boxes as the page is loading. The affected url can be seen below:...

BlueDragon 6.2.1 / 7.0 / 7.1 Cross Site Scripting

I. VULNERABILITY BlueDragon 6.2.1, 7.0, 7.1 Reflected Cross-Site Scripting II. SOURCE: http://www.newatlanta.com/c/products/bluedragon/download/home III. BACKGROUND BlueDragon is a family of runtime server-side products for the deployment of ColdFusion Markup Language CFML pages - with native...

Ninja Forms <= 2.9.21 - Authenticated Reflected Cross-Site Scripting (XSS)

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-admin/admin.php?page=nf-processing=...

OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134

The Open Semantic Framework OSF for Drupal is a middleware layer that allows structured data RDF and associated vocabularies ontologies to "drive" tailored tools and data displays within Drupal. The module is vulnerable to reflected Cross Site Scripting XSS because it did not sufficiently filter...

NewStatPress <= 1.0.4 - Reflected Cross-Site Scripting (XSS)

The NewStatPress plugin utilizes on lines 28 and 31 of the file ‘includes/nspsearch.php’ several variables from the $GET scope, without sanitation. While WordPress automatically escapes quotes on this scope, the outputs on these lines are outside of quotes, and as such can be utilized to trigger ...

Simple Share Buttons Adder <= 6.0.0 - Reflected Cross-Site Scripting (XSS)

A reflected XSS in "Simple Share Buttons Adder" before version 6.0.1 lead to a reflected cross-site scripting vulnerability on all pages where the "Simple Share Buttons Adder" was added usually all blog posts. Exploitation required that the browser did not encode the parameters sent to the server...

WordPress Videowall Plugin - Reflected Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in index.php pageid parameter. Solution Update the plugin...

WordPress Encrypted Blog Plugin <= 0.0.6.2 - Reflected Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability via encryptblogform.php redirectto parameter. Solution Update the plugin...

WSO2 Identity Server 5.0.0 XSS / CSRF / XXE Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: WSO2 Identity Server other WSO2 Carbon based products may be affected too...

Citizen Space <= 1.1 - Reflected Cross-Site Scripting (XSS)

The citizen-space WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

APSB15-08 Security bulletin available for Adobe Flex

An important vulnerability has been identified in the JavaScript output of the ASDoc tool available in Adobe Flex 4.6 and earlier versions. This vulnerability could lead to reflected cross-site scripting. Adobe recommends users perform the actions referenced in the "Solutions" section below to...

Ptengine <= 1.0.1 - Reflected Cross-Site Scripting (XSS)

The ptengine-real-time-web-analytics-and-heatmap WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

Ptengine <= 1.0.1 - Reflected Cross-Site Scripting (XSS)

The ptengine-real-time-web-analytics-and-heatmap WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/?account=1=1=1=0=1=1=1=1=1=PHNjcmlwdD5hbGVydCgnYnJva2VuIScpOzwvc2NyaXB0Pg== payload is base64 encoded in the code parameter...