Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting Detection

Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchange Server is vulnerable to a spoofing vulnerability.""" from kittysploit import from lib.protocols.http.httpclient...

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) Detection

There is a Cross Site Scripting XSS vulnerability in SpotPagelogin.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the dataperformredirect parameter. !/usr/bin/env python3 -- coding: utf-8 -- """There is a Cross Site Scripting XSS...

AppCMS - Cross-Site Scripting Detection

AppCMS 2.0.101 has a cross-site scripting vulnerability in \templates\m\inchead.php. !/usr/bin/env python3 -- coding: utf-8 -- """AppCMS 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AppCMS - Cross-Site Scriptin...

Reprise License Manager 14.2 - Cross-Site Scripting Detection

Reprise License Manager 14.2 contains a cross-site scripting vulnerability in the /goform/activateprocess "count" parameter via GET. !/usr/bin/env python3 -- coding: utf-8 -- """Reprise License Manager 14.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting Detection

WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the...

Wordpress Profile Builder Plugin Cross-Site Scripting Detection

The Profile Builder User Profile & User Registration Forms WordPress plugin is vulnerable to cross-site scripting due to insufficient escaping and sanitization of the siteurl parameter found in the /assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a...

WordPress WP JobSearch <1.5.1 - Cross-Site Scripting Detection

WordPress WP JobSearch plugin prior to 1.5.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

Microweber < 1.2.17 - Cross-Site Scripting Detection

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter.""" from kittysploit import from...

MantisBT < 2.25.2 - Cross-Site Scripting Detection

MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browsersearchplugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT...

Complete Online Job Search System 1.0 - Cross-Site Scripting Detection

Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch. !/usr/bin/env python3 -- coding: utf-8 -- """Complete Online Job Search System 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atma...

SolarView Compact 6.00 - Cross-Site Scripting Detection

SolarView Compact 6.00 contains a cross-site scripting vulnerability via SolarAiConf.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

kkFileView 4.1.0 - Cross-Site Scripting Detection

kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. !/usr/bin/env python3 -- coding: utf-8 -- """kkFileView 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Academy Learning Management System <5.9.1 - Cross-Site Scripting Detection

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Helmet Store Showroom - Cross Site Scripting Detection

Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting XSS. !/usr/bin/env python3 -- coding: utf-8 -- """Helmet Store Showroom 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Helmet Store Showroom - Cross...

WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting Detection

The WP-Optimize WordPress plugin before 3.2.13 and SrbTransLatin WordPress plugin before 2.4.1 are vulnerable to cross-site scripting due to a third-party library that improperly handles HTML character escaping. !/usr/bin/env python3 -- coding: utf-8 -- """The WP-Optimize WordPress plugin before...

Gnuboard 5 - Cross-Site Scripting Detection

Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter.""" from kittysploit import from lib.protocols.http.httpclient import...

myfactory FMS - Cross-Site Scripting Detection

myfactory.FMS before 7.1-912 allows cross-site scripting via the Error parameter. !/usr/bin/env python3 -- coding: utf-8 -- """myfactory.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'myfactory FMS - Cross-Site...

Apereo CAS Cross-Site Scripting Detection

Apereo CAS through 6.4.1 allows cross-site scripting via POST requests sent to the REST API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Apereo CAS through 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting Detection

The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting. !/usr/bin/env python3 -- coding: utf-8 -- """The Redirection for Contact Form 7 WordPress plugin before 2.""" from...