Aruba Airwave <8.2.3.1 - Cross-Site Scripting Detection

Aruba Airwave before version 8.2.3.1 is vulnerable to reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Aruba Airwave before version 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Aruba...

FineCMS <=5.0.10 - Cross-Site Scripting Detection

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. !/usr/bin/env python3 -- coding: utf-8 -- """FineCMS through 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HPE System Management - Cross-Site Scripting Detection

HPE System Management contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

DokuWiki - Cross-Site Scripting Detection

DokuWiki through 2017-02-19b contains a cross-site scripting vulnerability in the DATEAT parameter to doku.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting Detection

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress amty-thumb-recent-post plugin 8.""" from kittysploit import from lib.protocols.http.httpclient impo...

Jolokia 1.3.7 - Cross-Site Scripting Detection

Jolokia 1.3.7 is vulnerable to cross-site scripting in the HTTP servlet and allows an attacker to execute malicious JavaScript in the victim's browser. !/usr/bin/env python3 -- coding: utf-8 -- """Jolokia 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting Detection

Palo Alto Networks PAN-OS before 8.1.4 GlobalProtect Portal Login page allows an unauthenticated attacker to inject arbitrary JavaScript or HTML, making it vulnerable to cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto Networks PAN-OS before 8.""" from kittysploit impo...

IBM Planning Analytics - Authentication Bypass & Remote Code Execution Version Detection

IBM Planning Analytics versions 2.0.0 through 2.0.8 are vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Planning Analytics versions 2.""" fr...

NeDi 1.9C - Cross-Site Scripting Detection

NeDi 1.9C is vulnerable to cross-site scripting because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a...

Jeesns 1.4.2 - Cross-Site Scripting Detection

Jeesns 1.4.2 is vulnerable to reflected cross-site scripting in the /newVersion component and allows attackers to execute arbitrary web scripts or HTML. !/usr/bin/env python3 -- coding: utf-8 -- """Jeesns 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting Detection

McAfee ePolicy Orchestrator before 5.10.9 Update 9 is vulnerable to a cross-site scripting vulnerability that allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. reference: -...

Citrix ADC/Gateway - Cross-Site Scripting Detection

Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 contain a cross-site scripting vulnerability due to improper input validation. !/usr/bin/env python3 -- coding: utf-8 --...

Cacti - Cross-Site Scripting Detection

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti contains a cross-site scripting vulnerability via...

Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting Detection

Triconsole Datepicker Calendar before 3.77 contains a cross-site scripting vulnerability in calendarform.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents...

Php-mod/curl Library <2.3.2 - Cross-Site Scripting Detection

Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the postfilepathupload.php key parameter and the POST data to postmultidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other...

mojoPortal 2.7.0.0 - Cross-Site Scripting Detection

mojoPortal 2.7.0.0 contains a cross-site scripting vulnerability in the FileDialog.aspx component, which can allow an attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters. !/usr/bin/env python3 -- coding: utf-8 -- """mojoPortal 2.""" from...

Citrix Gateway and Citrix ADC - Cross-Site Scripting Detection

Citrix ADC and Citrix Gateway versions before 13.1 and 13.1-45.61, 13.0 and 13.0-90.11, 12.1 and 12.1-65.35 contain a cross-site scripting vulnerability due to improper input validation. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix ADC and Citrix Gateway versions before 13.""" from...

PMB 7.4.6 - Cross-Site Scripting Detection

PMB 7.4.6 contains a cross-site scripting vulnerability via the query parameter at /admin/convert/exportz3950new.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticatio...

cPanel < 11.109.9999.116 - Cross-Site Scripting Detection

An issue was discovered in cPanel before 11.109.9999.116. Cross Site Scripting can occur on the cpsrvd error page via an invalid webcall ID. !/usr/bin/env python3 -- coding: utf-8 -- """An issue was discovered in cPanel before 11.""" from kittysploit import from lib.protocols.http.httpclient impo...

OURPHP <= 7.2.0 - Cross Site Scripting Detection

OURPHP = 7.2.0 is vulnerale to Cross Site Scripting XSS via /client/manage/ourphpout.php. !/usr/bin/env python3 -- coding: utf-8 -- """OURPHP = 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OURPHP = 7.2.0 - Cros...