310 matches found
Order Processing MIS 跨站脚本漏洞
Order Processing MIS is iOrder's lightweight prototype for an order processing MIS. Order Processing MIS suffers from a cross-site scripting vulnerability that stems from the software's lack of filtering and escaping of user-submitted data. This vulnerability can be exploited by remote attackers ...
CVE-2020-23051
Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the firstname and lastname parameters of the registration form & loginsystem input fields...
SQL Injection in yeswiki/yeswiki
Description A boolean-based SQL Injection vulnerability has been found in the email parameter of the registration form. When a new user registers, the application first checks if the email exists through the emailExistsInDB function located in line 999 of the User.class.php. As you can see, it do...
Acronis: No server side check on terms of service page which leads to bypass
Hi team, I have found that there is no server side check implemented on the "Acronis Terms of Service and Privacy Statement" Page that is shown after filling the registration form which results in bypassing it without even accepting it. Steps To Reproduce: 1. Register as a new user by filling out...
Online Birth Certificate System 1.1 Cross Site Scripting
Exploit Title: Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting XSS Date: 03 July 2021 Exploit Author: Subhadip Nag Author Linkedin: www.linkedin.com/in/subhadip-nag-09/ Vendor Homepage: https://phpgurukul.com Software Link:...
Online Birth Certificate System 1.1 - (Multiple) Stored Cross-Site Scripting Vulnerability
Exploit Title: Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting XSS Exploit Author: Subhadip Nag Author Linkedin: www.linkedin.com/in/subhadip-nag-09/ Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/client-management-system-using-php-mysql...
Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting (XSS)
Exploit Title: Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting XSS Date: 03 July 2021 Exploit Author: Subhadip Nag Author Linkedin: www.linkedin.com/in/subhadip-nag-09/ Vendor Homepage: https://phpgurukul.com Software Link:...
WooCommerce Custom Registration Form <= 1.0.4 - Arbitrary Field Deletion and Form Modification via CSRF
The plugin does not properly check for CSRF in its delfield and savealldata AJAX actions, allowing attacker to make logged in user call them via a CSRF attack To delete a field from the Registration Form: To change the whole Registration Form: input type=...
WooCommerce Custom Registration Form <= 1.0.4 - Arbitrary Field Deletion and Form Modification via CSRF
The plugin does not properly check for CSRF in its delfield and savealldata AJAX actions, allowing attacker to make logged in user call them via a CSRF attack PoC To delete a field from the Registration Form: To change the whole Registration Form:...
CVE-2021-24158
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...
Default configuration
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...
CVE-2021-24158
CVE-2021-24158 affects Orbit Fox by ThemeIsle (WordPress plugin). Vulnerability: a registration form feature integrated with Elementor and Beaver Builder allows a lower-privileged user to supply the user_role parameter and set the default role for new registrations, despite the field being hidden...
CVE-2021-24158 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation
Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...
Web Based Quiz System 1.0 Cross Site Scripting
Exploit Title: Web Based Quiz System 1.0 - 'name' Persistent/Stored Cross-Site Scripting Date: 2021-03-02 Exploit Author: P.Naveen Kumar Vendor Homepage: https://www.sourcecodester.com Software Download Link :...
Web Based Quiz System 1.0 - 'name' Persistent Cross-Site Scripting
Exploit Title: Web Based Quiz System 1.0 - 'name' Persistent/Stored Cross-Site Scripting Date: 2021-03-02 Exploit Author: P.Naveen Kumar Vendor Homepage: https://www.sourcecodester.com Software Download Link :...
Web Based Quiz System 1.0 - (name) Persistent/Stored Cross-Site Scripting
Exploit Title: Web Based Quiz System 1.0 - 'name' Persistent/Stored Cross-Site Scripting Exploit Author: P.Naveen Kumar Vendor Homepage: https://www.sourcecodester.com Software Download Link : https://www.sourcecodester.com/php/14727/web-based-quiz-system-phpmysqli-full-source-code.html Software ...
OpenMage: Very long names on demo.openmage.org could redirect victim users to malicious url redirects via email contacts.
Summary: We found that the maximum length of the first and last name fields was not set to 32 characters at registration and to 1000 characters when using the profile update form. The attacker can use this method as a malware attack, the user will redirect to a website that contains malware or...
DRUPAL-CONTRIB-2021-001
The optional Social Auth Extra module enables you to use the single sign-on methods provided by Open Social e.g. Facebook, LinkedIn, Google and Twitter. The module doesn't implement a proper cache strategy for anonymous users allowing the registration form to be cached with disclosed information ...
Open Social - Moderately critical - Access bypass - SA-CONTRIB-2021-001
The optional Social Auth Extra module enables you to use the single sign-on methods provided by Open Social e.g. Facebook, LinkedIn, Google and Twitter. The module doesn't implement a proper cache strategy for anonymous users allowing the registration form to be cached with disclosed information ...