Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atma...

Haraj 3.7 - Cross-Site Scripting Detection

Haraj 3.7 contains a cross-site scripting vulnerability in the User Upgrade Form. An attacker can inject malicious script and thus steal authentication credentials and launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Haraj 3.""" from kittysploit import from...

Nortek Linear eMerge E3-Series - Cross-Site Scripting Detection

There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user. !/usr/bin/env python3 -- coding: utf-8 -- """There is a local session fixation vulnerability that, when chained with cross-site scripting,...

WWBN AVideo 11.6 - Cross-Site Scripting Detection

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'msg' parameter, which is inserted into the document with insufficient sanitization. !/usr/bin/env python3 -- coding: utf-8 -- """WWBN AVideo 11.""" from kittysploit import from...

Academy Learning Management System <5.9.1 - Cross-Site Scripting Detection

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

PDF Generator for WordPress < 1.1.2 - Cross Site Scripting Detection

The plugin includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin !/usr/bin/env python3 -- coding: utf-8 -- """The plugin includes a vendored dompdf example file which is susceptible to Reflected...

Helmet Store Showroom - Cross Site Scripting Detection

Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting XSS. !/usr/bin/env python3 -- coding: utf-8 -- """Helmet Store Showroom 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Helmet Store Showroom - Cross...

WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting Detection

The WP-Optimize WordPress plugin before 3.2.13 and SrbTransLatin WordPress plugin before 2.4.1 are vulnerable to cross-site scripting due to a third-party library that improperly handles HTML character escaping. !/usr/bin/env python3 -- coding: utf-8 -- """The WP-Optimize WordPress plugin before...

mojoPortal 2.7.0.0 - Cross-Site Scripting Detection

mojoPortal 2.7.0.0 contains a cross-site scripting vulnerability in the FileDialog.aspx component, which can allow an attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters. !/usr/bin/env python3 -- coding: utf-8 -- """mojoPortal 2.""" from...

XWiki >= 2.5-milestone-2 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as:...

IceWarp 11.4.6.0 - Cross-Site Scripting Detection

IceWarp 11.4.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS) Detection

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

Label Studio < 1.16.0 - Cross-Site Scripting Detection

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

IBM Eclipse Help System - Cross-Site Scripting Detection

IBM Eclipse Help System 6.1.0 through 6.1.0.6, 6.1.5 through 6.1.5.3, 7.0 through 7.0.0.2, and 8.0 prior to 8.0.0.1 contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env...

Froxlor Server Management - Cross-Site Scripting Detection

Froxlor Server Management is susceptible to cross-site scripting via clicking the forgot password link. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

RockMongo 1.1.8 - Cross-Site Scripting Detection

RockMongo 1.1.8 contains a cross-site scripting vulnerability which allows attackers to inject arbitrary JavaScript into the response returned by the application. !/usr/bin/env python3 -- coding: utf-8 -- """RockMongo 1.""" from kittysploit import from lib.protocols.http.httpclient import...

Samsung WLAN AP WEA453e - Cross-Site Scripting Detection

Samsung WLAN AP WEA453e router contains a cross-site scripting vulnerability. An attacker can execute arbitrary script and thus steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung WLAN AP WEA453e router contains a cross-site...

SteVe - Cross-Site Scripting Detection

SteVe contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 --...

Thruk Monitoring Webinterface - Cross-Site Scripting Detection

Thruk Monitoring Webinterface contains a cross-site scripting vulnerability via the login parameter at /thruk/cgi-bin/login.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Thruk Monitoring Webinterface contains a cross-site scripting vulnerability via the login parameter at /thruk/.""" from...

Tiki Wiki CMS Groupware v25.0 - Cross Site Scripting Detection

Tiki Wiki CMS Groupware version 25.0 suffers from a cross site scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki CMS Groupware version 25.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...