Weblate: Insecure Account Removal #2

Hi Team, This report is the pretty much same of my closed report here: 223355 , the difference is BUG2 when a user created an account BUT did not supply the password, therefor there is nothing to reauthenticate when deleting the account, it will successfully delete the account without supplying...

dev.thegcccoin.com XSS vulnerability

Vulnerable URL: https://dev.thegcccoin.com/registration-form/?pack=edu Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check...

thegccgroup.com XSS vulnerability

Open Bug Bounty ID: OBB-221429 Description| Value ---|--- Affected Website:| thegccgroup.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

pixxsel.de XSS vulnerability

Vulnerable URL: https://www.pixxsel.de/pixxsel/div/common/registrationform.jsp?downloadID=2497189=http%3A%2F%2Fwww.pixxsel.de%2Fangebote%2Ffotoschule Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...

franzis.de XSS vulnerability

Vulnerable URL: https://www.franzis.de/franzis/div/register/registrationform.jsp Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 14:52 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 60470 VIP website status:|...

CVE-2016-9838

An issue was discovered in components/comusers/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the session on a validation error enables a user to gain access to a registered user's account and reset the user's group mappings, username, and...

CVE-2016-9838

An issue was discovered in components/comusers/models/registration.php in Joomla! before 3.6.5. Incorrect filtering of registration form data stored to the session on a validation error enables a user to gain access to a registered user's account and reset the user's group mappings, username, and...

Adobe Marketing Cloud - Bypass & Persistent Vulnerability

Document Title: =============== Adobe Marketing Cloud - Bypass & Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1939 Release Date: ============= 2016-11-14 Vulnerability Laboratory ID VL-ID: ====================================...

e107 CMS-2.1.1 privilege elevation vulnerability

No description provided by source. $login, 'userpass' = $pass, 'userlogin' = 'Sign In'; curlsetopt$ch, CURLOPTPOST, 1; $content = curlexec$ch; if strpos$content, '?logout' === false die"Cannot login"; $data = array; $data'useradmin' = 1; $data'userperms' = 0; $data'userpassword' = md5$pass;...

WordPress Plugin church_admin 0.800 - Persistent Cross-Site Scripting

WordPress Plugin churchadmin 0.800 - Persistent Cross-Site Scripting Exploit Title: Wordpress churchadmin Stored XSS Date: 21-04-2015 Exploit Author: woodspeed Vendor Homepage: https://wordpress.org/plugins/church-admin/ Version: 0.800 OSVDB ID : http://www.osvdb.org/show/osvdb/121304 WPVULNDB ID...

WordPress Plugin church_admin 0.800 - Persistent Cross-Site Scripting

Exploit Title: Wordpress churchadmin Stored XSS Date: 21-04-2015 Exploit Author: woodspeed Vendor Homepage: https://wordpress.org/plugins/church-admin/ Version: 0.800 OSVDB ID : http://www.osvdb.org/show/osvdb/121304 WPVULNDB ID : https://wpvulndb.com/vulnerabilities/7999 Category: webapps 1...

HostingTakip 3.0 Cross Site Scripting

HostingTakip v3.0 - Stored XSS Vulnerability My + Discovered by: KnocKout Contact : [email protected] HomePage : http://h4x0resec.blogspot.com Love to UnDeRTaKeR & BARCOD3 & Septemb0x & ZoRLu milw00rm.com Software info |Web App. : HostingTakip |Affected Version : v3.0 |Software :...

CVE-2014-9439

Cross-site scripting XSS vulnerability in Easy File Sharing Web Server 6.8 allows remote attackers to inject arbitrary web script or HTML via the username field during registration, which is not properly handled by forum.ghp...

kppw威客系统SQL注入一枚

简要描述： rt 详细说明： 注册处。 function checkall$regusername, $regemail, $regcode global $lang,$K; $res1 = $this-checkip ; if$K'do' $url = 'index.php?do='.$K'do'; else $url = 'index.php?do=register'; $res1 === true or $result = $res1; $res2 = $this-checkusername $regusername ; $res2 === true or $result =...

open auto classifieds <= 1.5.9 - Multiple Vulnerabilities

No description provided by source. MorningStar Security - Advisory http://www.morningstarsecurity.com/ Multiple security issues in Open Auto Classifieds 1. Advisory Information ---------------------------------------------------------------------------------------------- Title: Multiple security...

Sitekit CMS 6.6 registration-form.html ClickFrom Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/16016/info Sitekit CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to hav...

PHPBB MOD [2.0.19] Invitation Only (PassCode Bypass vulnerability)

No description provided by source. PHPBB MOD 2.0.19 Invitation Only PassCode Bypass vulnerability ------------------------------------------------------------------------------- 0 | | | | | | TM 1 | | | | | | 0 | / | ' \ / | ' \ / |/ | |/ / \ '| ' \ / \ | 1 / / | | | | / | | | | | | | / | | | | |...

IRCCloud: CSRF - Creating accounts

Hi there, I've discovered the following CSRF issue: There's no CSRF / Bot protection on the registration form. Details An attacker could automate the registration process to flood your database with invalid/useless accounts. He could also source the process out to his victims CSRF. Steps to...

HackerOne: Hackerone Email Addresses Enumeration

Enumeration of email addresses of already registered users is possible, and or, checking if a user with specific email address is registered in the website and will then be used for phising attacks or any malicious intent. In the "Forgot Password" section, there is an implemented security measure...

UBUNTU-CVE-2013-7303

Multiple cross-site scripting XSS vulnerabilities in 1 squelettes-dist/formulaires/inscription.php and 2 prive/forms/editerauteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field...