Microweber < V.2.0 - Cross-Site Scripting Detection

Reflected Cross-Site Scripting Vulnerability in types GET parameter on the /editortools/rteimageeditor endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected Cross-Site Scripting Vulnerability in types GET parameter on the /editortools/rteimageeditor endp.""" from kittysploit import fro...

XWiki >= 6.2-milestone-1 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...

mooDating 1.2 - Cross-site scripting Detection

A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. !/usr/bin/env python3 -...

Academy LMS 6.0 - Cross-Site Scripting Detection

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Creative Item Academy LMS 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

IceWarp 11.4.6.0 - Cross-Site Scripting Detection

IceWarp 11.4.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

mojoPortal v.2.7.0.0 - Cross-Site Scripting Detection

Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component. !/usr/bin/env python3 -- coding: utf-8 -- """Cross Site Scripting vulnerability in mojoPortal v.""" from kittysploit import from...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS) Detection

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

XWiki - Cross-Site Scripting Detection

XWiki is vulnerable to reflected Cross-Site Scripting XSS via the viewer=changes endpoint. The rev2 parameter is not properly sanitised before being rendered in the response, allowing an attacker to inject arbitrary JavaScript. Affects XWiki versions prior to the patched release. !/usr/bin/env...

OpenCMS - Cross-Site Scripting Detection

OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """OpenCMS below 10.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenCMS - Cross-Site Scripting...

IBM Eclipse Help System - Cross-Site Scripting Detection

IBM Eclipse Help System 6.1.0 through 6.1.0.6, 6.1.5 through 6.1.5.3, 7.0 through 7.0.0.2, and 8.0 prior to 8.0.0.1 contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env...

Discourse - Cross-Site Scripting Detection

Discourse contains a cross-site scripting vulnerability. An attacker can execute arbitrary script and thus steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Discourse contains a cross-site scripting vulnerability.""" from...

EP Web Solutions CMS - Cross Site Scripting Detection

Cross-site scripting is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting is an attack in which an attacker injects malicious executable scripts into the code of...

WordPress Flow-Flow Social Stream <=3.0.71 - Cross-Site Scripting Detection

WordPress Flow-Flow Social Stream 3.0.7.1 and prior is vulnerable to cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Flow-Flow Social Stream 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

TP-Link Archer A20 v3 Router - Cross-site Scripting Detection

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

Label Studio < 1.16.0 - Cross-Site Scripting Detection

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

Drupal Avatar Uploader - Cross-Site Scripting Detection

Drupal Avatar Uploader v7.x-1.0-beta8 plugin contains a cross-site scripting vulnerability in the slider import search feature and tab parameter via plugin settings. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Avatar Uploader v7.""" from kittysploit import from lib.protocols.http.httpclie...

Let's Encrypt - Cross-Site Scripting Detection

Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL certificates. !/usr/bin/env python3 -- coding: utf-8 -- """Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL cert.""" from kittysploit...

Avaya Aura Utility Services Administration - Cross-Site Scripting Detection

Avaya Aura Utility Services Administration contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch oth...

Adobe Experience Manager - Cross-Site Scripting Detection

Adobe Experience Manager contains a cross-site scripting vulnerability via setPreferences. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe Experience Manager contains a cross-site scripting vulnerability via setPreferences.""" from kittysploit import from lib.protocols.http.httpclient import...