Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the graph parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet contains a cross-site...

Popup by Supsystic <1.10.5 - Cross-Site scripting Detection

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Popup by Supsystic before 1.""" from kittysploit import...

WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting Detection

WordPress Simple Giveaways plugin before 2.36.2 contains a cross-site scripting vulnerability via the method and share GET parameters of the Giveaway pages, which are not sanitized, validated, or escaped before being output back in the pages. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting Detection

WordPress Pro Real Estate 7 theme before 3.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the ctcommunity parameter in its search listing page before outputting it back. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Pro Real Estate 7 theme befo...

WOOF WordPress plugin - Cross-Site Scripting Detection

The WOOF WordPress plugin does not sanitize or escape the woofredrawelements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """The WOOF WordPress plugin does not sanitize or escape the woofredrawelements...

Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting Detection

Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. !/usr/bin/env python3 -- coding: utf-8 -- """Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on.""" from...

WP-FaceThumb 0.1 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the paginationwpfacethumb parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in index.""" fro...

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the...

ElasticSearch v1.1.1/1.2 RCE Detection

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

WordPress DZS-VideoGallery Plugin Cross-Site Scripting Detection

Multiple cross-site scripting vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio DZS Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 swfloc or 2 designrand parameter. !/usr/bin/env python3 -- coding: utf-8 --...

Nordex NC2 - Cross-Site Scripting Detection

Nordex NC2 contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks...

WordPress AJAX Random Post <=2.00 - Cross-Site Scripting Detection

WordPress AJAX Random Post 2.00 is vulnerable to reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress AJAX Random Post 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress AJ...

WordPress anti-plagiarism <=3.60 - Cross-Site Scripting Detection

WordPress anti-plagiarism 3.6.0 and prior are vulnerable to reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress anti-plagiarism 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

WordPress e-search <=1.0 - Cross-Site Scripting Detection

Wordpress plugin e-search 1.0 and before contains a cross-site scripting vulnerability via dateselect.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting Detection

WordPress HDW Video Gallery 1.2 and before contains a cross-site scripting vulnerability via playlist.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

WordPress Admin Font Editor <=1.8 - Cross-Site Scripting Detection

WordPress Admin Font Editor plugin indexisto 1.8 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting Detection

WordPress Stop User Enumeration 1.3.7 and earlier are vulnerable to unauthenticated reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Stop User Enumeration 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Sympa version =>6.2.16 - Cross-Site Scripting Detection

Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs. !/usr/bin/env python3 -- coding: utf-8 -- """Sympa version 6.""...

Zend Server <9.13 - Cross-Site Scripting Detection

Zend Server before version 9.13 is vulnerable to cross-site scripting via the debughost parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Zend Server before version 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

WordPress JSmol2WP <=1.07 - Cross-Site Scripting Detection

WordPress JSmol2WP version 1.07 and earlier is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress JSmol2WP version 1.""" from kittysploit import from...