Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting Detection

Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting XSS vulnerability via requesttoken.php. !/usr/bin/env python3 -- coding: utf-8 -- """Portal do Software Publico Brasileiro i3geo v7.""" from kittysploit import from lib.protocols.http.httpclient...

kkFileView 4.1.0 - Cross-Site Scripting Detection

kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...

WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting Detection

WordPress Sunshine Photo Cart plugin before 2.9.15 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affecte...

kkFileView 4.1.0 - Cross-Site Scripting Detection

kkFileView 4.1.0 is susceptible to cross-site scripting via the url parameter at /controller/OnlinePreviewController.java. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Academy LMS 6.0 - Cross-Site Scripting Detection

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Creative Item Academy LMS 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

Microweber < V.2.0 - Cross-Site Scripting Detection

Reflected Cross-Site Scripting Vulnerability in types GET parameter on the /editortools/rteimageeditor endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected Cross-Site Scripting Vulnerability in types GET parameter on the /editortools/rteimageeditor endp.""" from kittysploit import fro...

NeDi 1.9C - Cross-Site Scripting Detection

NeDi 1.9C is vulnerable to cross-site scripting because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a...

twitter-server Cross-Site Scripting Detection

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. !/usr/bin/env python3 -- coding: utf-8 -- """twitter-serve...

WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting Detection

WordPress Ultimate FAQ plugin before 1.8.30 is susceptible to cross-site scripting via DisplayFAQ to Shortcodes/DisplayFAQs.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Jeedom <=4.0.38 - Cross-Site Scripting Detection

Jeedom through 4.0.38 contains a cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Jeedom through 4.""" from kittysploit import from...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the graph parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet contains a cross-site...

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting Detection

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Supsystic Contact Form plugin before 1."""...

WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting Detection

WordPress Pro Real Estate 7 theme before 3.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the ctcommunity parameter in its search listing page before outputting it back. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Pro Real Estate 7 theme befo...

WOOF WordPress plugin - Cross-Site Scripting Detection

The WOOF WordPress plugin does not sanitize or escape the woofredrawelements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """The WOOF WordPress plugin does not sanitize or escape the woofredrawelements...

Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting Detection

Triconsole Datepicker Calendar before 3.77 contains a cross-site scripting vulnerability in calendarform.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents...

AppCMS - Cross-Site Scripting Detection

AppCMS 2.0.101 has a cross-site scripting vulnerability in \templates\m\inchead.php. !/usr/bin/env python3 -- coding: utf-8 -- """AppCMS 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AppCMS - Cross-Site Scriptin...

HTTPBin - Cross-Site Scripting Detection

HTTPBin contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """HTTPBin contains a cross-site scriptin...

JavaMelody - Cross-Site Scripting Detection

JavaMelody contains a cross-site scripting vulnerability via the monitoring parameter. An attacker can execute arbitrary script in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 --...

Retool < 3.88 - SVG Cross-Site Scripting Detection

This template checks for SVG Cross-Site ScriptingXSS vulnerability via the Image Proxy URL parameter in Retool. !/usr/bin/env python3 -- coding: utf-8 -- """This template checks for SVG Cross-Site ScriptingXSS vulnerability via the Image Proxy URL parameter in Reto.""" from kittysploit import fro...