Academy Learning Management System <5.9.1 - Cross-Site Scripting Detection

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

RPCMS 3.0.2 - Cross-Site Scripting Detection

RPCMS 3.0.2 contains a cross-site scripting vulnerability in the Search function. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Helmet Store Showroom - Cross Site Scripting Detection

Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting XSS. !/usr/bin/env python3 -- coding: utf-8 -- """Helmet Store Showroom 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Helmet Store Showroom - Cross...

WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting Detection

The WP-Optimize WordPress plugin before 3.2.13 and SrbTransLatin WordPress plugin before 2.4.1 are vulnerable to cross-site scripting due to a third-party library that improperly handles HTML character escaping. !/usr/bin/env python3 -- coding: utf-8 -- """The WP-Optimize WordPress plugin before...

mojoPortal 2.7.0.0 - Cross-Site Scripting Detection

mojoPortal 2.7.0.0 contains a cross-site scripting vulnerability in the FileDialog.aspx component, which can allow an attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters. !/usr/bin/env python3 -- coding: utf-8 -- """mojoPortal 2.""" from...

XWiki >= 2.5-milestone-2 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as:...

IceWarp 11.4.6.0 - Cross-Site Scripting Detection

IceWarp 11.4.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

WordPress Checklist <1.1.9 - Cross-Site Scripting Detection

WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Checklist plugin before 1.""" from kittysploit import from...

phpMyChat-Plus 1.98 - Cross-Site Scripting Detection

phpMyChat-Plus 1.98 contains a cross-site scripting vulnerability via pmcusername parameter of passreset.php in password reset URL. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyChat-Plus 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Jeesns 1.4.2 - Cross-Site Scripting Detection

Jeesns 1.4.2 is vulnerable to reflected cross-site scripting in the /newVersion component and allows attackers to execute arbitrary web scripts or HTML. !/usr/bin/env python3 -- coding: utf-8 -- """Jeesns 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

IceWarp WebMail 11.4.5.0 - Cross-Site Scripting Detection

IceWarp WebMail 11.4.5.0 is vulnerable to cross-site scripting via the language parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebMail 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IceWarp...

Php-mod/curl Library <2.3.2 - Cross-Site Scripting Detection

Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the postfilepathupload.php key parameter and the POST data to postmultidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other...

Apereo CAS Cross-Site Scripting Detection

Apereo CAS through 6.4.1 allows cross-site scripting via POST requests sent to the REST API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Apereo CAS through 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Reprise License Manager 14.2 - Cross-Site Scripting Detection

Reprise License Manager 14.2 contains a cross-site scripting vulnerability in the /goform/activateprocess "count" parameter via GET. !/usr/bin/env python3 -- coding: utf-8 -- """Reprise License Manager 14.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting Detection

WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the...

WordPress Ad Inserter <2.7.10 - Cross-Site Scripting Detection

WordPress Ad Inserter plugin before 2.7.10 contains a cross-site scripting vulnerability. It does not sanitize and escape the htmlelementselection parameter before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Ad Inserter plugin before 2.""" from kittysplo...

WordPress WP JobSearch <1.5.1 - Cross-Site Scripting Detection

WordPress WP JobSearch plugin prior to 1.5.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting Detection

WordPress Shortcodes and extra features plugin for the Phlox theme before 2.9.8 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting...

Microweber < 1.2.17 - Cross-Site Scripting Detection

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter.""" from kittysploit import from...

MantisBT < 2.25.2 - Cross-Site Scripting Detection

MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browsersearchplugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT...