phpMyChat-Plus 1.98 - Cross-Site Scripting Detection

phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmcusername parameter of passreset.php in password reset URL. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyChat-Plus 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

twitter-server Cross-Site Scripting Detection

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. !/usr/bin/env python3 -- coding: utf-8 -- """twitter-serve...

Accela Civic Platform <=21.1 - Cross-Site Scripting Detection

Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via the security/hostSignon.do parameter servProvCode. !/usr/bin/env python3 -- coding: utf-8 -- """Accela Civic Platform through 21.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Adobe ColdFusion - Cross-Site Scripting Detection

Adobe ColdFusion debug page contains a cross-site scripting vulnerability when the application is running on a remote host. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Tiki Wiki CMS Groupware 7.0 Cross-Site Scripting Detection

Tiki Wiki CMS Groupware 7.0 is vulnerable to cross-site scripting via the GET "ajax" parameter to snarfajax.php. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki CMS Groupware 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting Detection

AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sa."""...

WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting Detection

Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 notify or 2 blog parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple cross-site scripting vulnerabiliti...

WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in...

Combodo iTop <2.2.0-2459 - Cross-Site Scripting Detection

Combodo iTop before 2.2.0-2459 contains a cross-site scripting vulnerability in application/dashboard.class.inc.php which allows remote attackers to inject arbitrary web script or HTML via a dashboard title. !/usr/bin/env python3 -- coding: utf-8 -- """Combodo iTop before 2.""" from kittysploit...

WordPress e-search <=1.0 - Cross-Site Scripting Detection

WordPress e-search 1.0 and before contains a reflected cross-site scripting vulnerability via titleaz.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Fortinet FortiOS - Open Redirect/Cross-Site Scripting Detection

FortiOS Web User Interface in 5.0.x before 5.0.13, 5.2.x before 5.2.3, and 5.4.x before 5.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting attacks via the "redirect" parameter to "login." !/usr/bin/env python3 -- coding: utf...

Oracle Content Server - Cross-Site Scripting Detection

Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site. !/usr/bin/env...

Dreambox WebControl 2.0.0 - Cross-Site Scripting Detection

Dream Multimedia Dreambox devices via their WebControl component are vulnerable to reflected cross-site scripting, as demonstrated by the "Name des Bouquets" field, or the file parameter to the /file URI. !/usr/bin/env python3 -- coding: utf-8 -- """Dream Multimedia Dreambox devices via their...

Fortinet FortiOS < 5.6.0 - Cross-Site Scripting Detection

A Cross-Site Scripting vulnerability in Fortinet FortiOS versions 5.6.0 and earlier allows attackers to Execute unauthorized code or commands via the action input during the activation of a FortiToken. !/usr/bin/env python3 -- coding: utf-8 -- """A Cross-Site Scripting vulnerability in Fortinet...

IceWarp WebMail 11.3.1.5 - Cross-Site Scripting Detection

IceWarp WebMail 11.3.1.5 is vulnerable to cross-site scripting via the language parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebMail 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IceWarp...

WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting Detection

WordPress HDW Video Gallery 1.2 and before contains a cross-site scripting vulnerability via mychannel.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

WordPress heat-trackr 1.0 - Cross-Site Scripting Detection

WordPress heat-trackr 1.0 contains a cross-site scripting vulnerability via heat-trackrabtestadd.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticati...

WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting Detection

WordPress plugin Infusionsoft 1.5.11 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Aruba Airwave <8.2.3.1 - Cross-Site Scripting Detection

Aruba Airwave before version 8.2.3.1 is vulnerable to reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Aruba Airwave before version 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Aruba...

FineCMS <=5.0.10 - Cross-Site Scripting Detection

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. !/usr/bin/env python3 -- coding: utf-8 -- """FineCMS through 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...