WebPort 1.19.1 - Cross-Site Scripting Detection

Web Port 1.19.1 is vulnerable to cross-site scripting via the /log type parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Web Port 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WebPort 1.19.1 - Cross-Site...

LiveZilla Server 8.0.1.0 - Cross-Site Scripting Detection

LiveZilla Server 8.0.1.0 is vulnerable to reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """LiveZilla Server 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'LiveZilla Server 8.0.1.0 -...

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting Detection

Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Open-School 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

SugarCRM Enterprise 9.0.0 - Cross-Site Scripting Detection

SugarCRM Enterprise 9.0.0 contains a cross-site scripting vulnerability via mobile/error-not-supported-platform.html?desktopurl. !/usr/bin/env python3 -- coding: utf-8 -- """SugarCRM Enterprise 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting Detection

Rumpus FTP Web File Manager 8.2.9.1 contains a reflected cross-site scripting vulnerability via the Login page. An attacker can send a crafted link to end users and can execute arbitrary JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Rumpus FTP Web File Manager 8.""" from kittysploit...

Pypiserver <1.2.5 - Carriage Return Line Feed Injection Detection

Pypiserver through 1.2.5 and below is susceptible to carriage return line feed injection. An attacker can set arbitrary HTTP headers and possibly conduct cross-site scripting attacks via a %0d%0a in a URI. !/usr/bin/env python3 -- coding: utf-8 -- """Pypiserver through 1.""" import re from...

Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting Detection

Event Espresso Core-Reg 4.10.7.p is vulnerable to cross-site scripting in wp-content/plugins/event-espresso-core-reg/adminpages/messages/templates/eemsgadminoverview.template.php and allows remote attackers to inject arbitrary web script or HTML via the page parameter. !/usr/bin/env python3 --...

WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting Detection

WordPress Ultimate FAQ plugin before 1.8.30 is susceptible to cross-site scripting via DisplayFAQ to Shortcodes/DisplayFAQs.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting Detection

Jira Subversion ALM for Enterprise before 8.8.2 contains a cross-site scripting vulnerability at multiple locations. !/usr/bin/env python3 -- coding: utf-8 -- """Jira Subversion ALM for Enterprise before 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Adobe ColdFusion - Cross-Site Scripting Detection

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting Detection

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Supsystic Contact Form plugin before 1."""...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Mautic <3.3.4 - Cross-Site Scripting Detection

Mautic before 3.3.4 contains a cross-site scripting vulnerability on the password reset page in the bundle parameter of the URL. An attacker can inject arbitrary script, steal cookie-based authentication credentials, and/or launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Mautic...

Monstra CMS <=3.0.4 - Cross-Site Scripting Detection

Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

Fortinet FortiOS - Cross-Site Scripting Detection

Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below versions under SSL VPN web portal are vulnerable to cross-site scripting and allows attacker to execute unauthorized malicious script code via the error or message handling parameters. !/usr/bin/env python3 -- coding:...

WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting Detection

WordPress SagePay Server Gateway for WooCommerce before 1.0.9 is vulnerable to cross-site scripting via the includes/pages/redirect.php page parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress SagePay Server Gateway for WooCommerce before 1.""" from kittysploit import from...

SugarCRM 3.5.1 - Cross-Site Scripting Detection

SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string aka a $key variable. !/usr/bin/env python3 -- coding: utf-8 -- """SugarCRM 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Jenkins build-metrics 1.3 - Cross-Site Scripting Detection

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins build-metrics 1.""" from kittysploit import from...

WordPress Checklist <1.1.9 - Cross-Site Scripting Detection

WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Checklist plugin before 1.""" from kittysploit import from...

MicroStrategy Library <11.1.3 - Cross-Site Scripting Detection

MicroStrategy Library before 11.1.3 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...