Oracle Content Server - Cross-Site Scripting Detection

Oracle Content Server version 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0 are susceptible to cross-site scripting. The vulnerability can be used to include HTML or JavaScript code in the affected web page. The code is executed in the browser of users if they visit the manipulated site. !/usr/bin/env...

FineCMS <=5.0.10 - Cross-Site Scripting Detection

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. !/usr/bin/env python3 -- coding: utf-8 -- """FineCMS through 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting Detection

WordPress Stop User Enumeration 1.3.7 and earlier are vulnerable to unauthenticated reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Stop User Enumeration 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Zend Server <9.13 - Cross-Site Scripting Detection

Zend Server before version 9.13 is vulnerable to cross-site scripting via the debughost parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Zend Server before version 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Monstra CMS <=3.0.4 - Cross-Site Scripting Detection

Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting Detection

McAfee ePolicy Orchestrator before 5.10.9 Update 9 is vulnerable to a cross-site scripting vulnerability that allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. reference: -...

WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting Detection

WordPress Simple Giveaways plugin before 2.36.2 contains a cross-site scripting vulnerability via the method and share GET parameters of the Giveaway pages, which are not sanitized, validated, or escaped before being output back in the pages. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

Accela Civic Platform <=21.1 - Cross-Site Scripting Detection

Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via the security/hostSignon.do parameter servProvCode. !/usr/bin/env python3 -- coding: utf-8 -- """Accela Civic Platform through 21.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting Detection

Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. !/usr/bin/env python3 -- coding: utf-8 -- """Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on.""" from...

Juniper Web Device Manager - Cross-Site Scripting Detection

Juniper Web Device Manager J-Web in Junos OS contains a cross-site scripting vulnerability. This can allow an unauthenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web, which can allow the attacker to steal...

Trilium <0.52.4 - Cross-Site Scripting Detection

Trilium prior to 0.52.4, 0.53.1-beta contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Trilium prior to 0.""" from...

Gnuboard 5 - Cross-Site Scripting Detection

Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter.""" from kittysploit import from lib.protocols.http.httpclient import...

Contao <4.13.3 - Cross-Site Scripting Detection

Contao prior to 4.13.3 contains a cross-site scripting vulnerability. It is possible to inject arbitrary JavaScript code into the canonical tag. !/usr/bin/env python3 -- coding: utf-8 -- """Contao prior to 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting Detection

Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the indexen.php 'from' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Parallels H-Sphere 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

Microweber <1.3.2 - Cross-Site Scripting Detection

Code Injection in on search.php?keywords= GitHub repository microweber/microweber prior to 1.3.2. !/usr/bin/env python3 -- coding: utf-8 -- """Code Injection in on search.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name...

PMB 7.4.6 - Cross-Site Scripting Detection

PMB 7.4.6 contains a cross-site scripting vulnerability via the query parameter at /admin/convert/exportz3950new.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticatio...

MooDating 1.2 - Cross-site scripting Detection

A vulnerability, which was classified as problematic, has been found in mooSocial mooDating 1.2. This issue affects some unknown processing of the file /users/view of the component URL Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. !/usr/bin/env...

TP-Link Archer A20 v3 Router - Cross-site Scripting Detection

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

WWBN AVideo 11.6 - Cross-Site Scripting Detection

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'toast' parameter, which is inserted into the document with insufficient sanitization. !/usr/bin/env python3 -- coding: utf-8 -- """WWBN AVideo 11.""" from kittysploit import from...

ServiceNow - Cross-Site Scripting Detection

ServiceNow through San Diego Patch 4b and Patch 6 contains a cross-site scripting vulnerability in the logout functionality, which can enable an unauthenticated remote attacker to execute arbitrary JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """ServiceNow through San Diego Patch 4b and...