MicroStrategy Library <11.1.3 - Cross-Site Scripting Detection

MicroStrategy Library before 11.1.3 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting Detection

Rumpus FTP Web File Manager 8.2.9.1 contains a reflected cross-site scripting vulnerability via the Login page. An attacker can send a crafted link to end users and can execute arbitrary JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Rumpus FTP Web File Manager 8.""" from kittysploit...

KindEditor 4.1.11 - Cross-Site Scripting Detection

KindEditor 4.1.11 contains a cross-site scripting vulnerability via the php/demo.php content1 parameter. !/usr/bin/env python3 -- coding: utf-8 -- """KindEditor 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Avaya Aura Utility Services Administration - Cross-Site Scripting Detection

Avaya Aura Utility Services Administration contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch oth...

Adobe ColdFusion - Cross-Site Scripting Detection

Adobe ColdFusion debug page contains a cross-site scripting vulnerability when the application is running on a remote host. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Fortinet FortiOS - Open Redirect/Cross-Site Scripting Detection

FortiOS Web User Interface in 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting attacks via the "redirect" parameter to "login." !/usr/bin/env python3 -- coding: utf...

Aruba Airwave <8.2.3.1 - Cross-Site Scripting Detection

Aruba Airwave before version 8.2.3.1 is vulnerable to reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Aruba Airwave before version 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Aruba...

HPE System Management - Cross-Site Scripting Detection

HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting Detection

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress amty-thumb-recent-post plugin 8.""" from kittysploit import from lib.protocols.http.httpclient impo...

Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting Detection

Adiscon LogAnalyzer before 4.1.7 contains a cross-site scripting vulnerability in the 'referer' parameter of the login.php file. !/usr/bin/env python3 -- coding: utf-8 -- """Adiscon LogAnalyzer before 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress JSmol2WP <=1.07 - Cross-Site Scripting Detection

WordPress JSmol2WP version 1.07 and earlier is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress JSmol2WP version 1.""" from kittysploit import from...

WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting Detection

WordPress SagePay Server Gateway for WooCommerce before 1.0.9 is vulnerable to cross-site scripting via the includes/pages/redirect.php page parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress SagePay Server Gateway for WooCommerce before 1.""" from kittysploit import from...

WebPort 1.19.1 - Cross-Site Scripting Detection

Web Port 1.19.1 is vulnerable to cross-site scripting via the /log type parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Web Port 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WebPort 1.19.1 - Cross-Site...

SugarCRM Enterprise 9.0.0 - Cross-Site Scripting Detection

SugarCRM Enterprise 9.0.0 contains a cross-site scripting vulnerability via mobile/error-not-supported-platform.html?desktopurl. !/usr/bin/env python3 -- coding: utf-8 -- """SugarCRM Enterprise 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WordPress API Bearer Auth <20190907 - Cross-Site Scripting Detection

WordPress API Bearer Auth plugin before 20190907 contains a cross-site scripting vulnerability. The server parameter is not correctly filtered in swagger-config.yaml.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress API Bearer Auth plugin before 20190907 contains a cross-site scripting...

phpMyChat-Plus 1.98 - Cross-Site Scripting Detection

phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmcusername parameter of passreset.php in password reset URL. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyChat-Plus 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection

IBM Planning Analytics versions 2.0.0 through 2.0.8 are vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Planning Analytics versions 2.""" fr...

Pypiserver <1.2.5 - Carriage Return Line Feed Injection Detection

Pypiserver through 1.2.5 and below is susceptible to carriage return line feed injection. An attacker can set arbitrary HTTP headers and possibly conduct cross-site scripting attacks via a %0d%0a in a URI. !/usr/bin/env python3 -- coding: utf-8 -- """Pypiserver through 1.""" import re from...

Linear eMerge E3 - Cross-Site Scripting Detection

Linear eMerge E3-Series devices are vulnerable to cross-site scripting via the 'layout' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Linear eMerge E3-Series devices are vulnerable to cross-site scripting via the 'layout' parameter.""" from kittysploit import from...

D-Link DIR-816L 2.x - Cross-Site Scripting Detection

D-Link DIR-816L devices 2.x before 1.10b04Beta02 contains a cross-site scripting vulnerability. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter before being printed on the webpage. An attacker can inject arbitrary script in the browser of an unsuspecting us...