CVE-2018-9015

CVE-2018-9015 affects dsmall v20180320, with a cross-site scripting (XSS) vulnerability exploitable via the public/index.php/home/predeposit/index.html page’s pdr_sn parameter (the CMS search box). The issue stems from unsanitized input in the pdr_sn field, enabling injection of arbitrary web scr...

CVE-2018-9017: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...

PT-2018-18781

Name of the Vulnerable Software and Affected Versions dsmall version v20180320 Description The issue allows for XSS via the pdr sn parameter in the "public/index.php/home/predeposit/index.html" API endpoint, which is also referred to as the CMS search box. Recommendations For version v20180320,...

PT-2018-18782

Name of the Vulnerable Software and Affected Versions dsmall version 20180320 Description The issue allows for XSS via the main page search box at the "public/index.php/home" URI. Recommendations For version 20180320, avoid using the search box in the main page until a fix is available. As a...

PT-2018-18783

Name of the Vulnerable Software and Affected Versions dsmall version 20180320 Description The issue allows for XSS via the member search box at the "public/index.php/home/membersnsfriend/findlist.html" URI. Recommendations For version 20180320, consider restricting access to the member search box...

CVE-2018-9016: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI...

CVE-2018-9015: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

Microsoft SharePoint Limited Access Permission Bypass

vulnerability Title: Microsoft SharePoint 'Limited Access' Permission Bypass This vulnerability was discovered by 'Behnam Vanda' January 07, 2018 ====================== I. About Vulnerability ====================== A permission level bypass vulnerability has been identified in microsoft sharePoin...

Cross-site scripting vulnerability in OurPHP search box

OurPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. A cross-site scripting vulnerability exists in the search box of OurPHP version 1.7.3, due to the failure of the system's search box to strictly filter parameters...

SDCMS Search Box SQL Injection Vulnerability

SDCMS is a PHP 3-in-1 website management system independently developed by Fireworks Network. An SQL injection vulnerability exists in the SDCMS search box. The vulnerability stems from failure to filter user input. An attacker can exploit this vulnerability to obtain sensitive information from t...

Reflective Cross-site Scripting Vulnerability in ESPCMS Enterprise Web Management System V6.7.17.04.05

ESPCMS enterprise website management system is based on LAMP development and construction of enterprise website management system. A reflective cross-site scripting vulnerability exists in the search box of the ESPCMS enterprise website management system. The vulnerability allows attackers to...

Command Execution Vulnerability in Apple CMS wd Parameter

Apple CMS program is a fast website building system that runs on PHP+MYSQL environment. A command execution vulnerability exists in the wd parameter of the search box of Apple CMS. The vulnerability stems from the failure of the wd parameter to adequately filter user-supplied input, which allows ...

SemCms asp version search box has SQL injection vulnerability

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers.SemCms using php and vb language writing, combined with apache or iis running. SemCms asp version of the search b...

IrIran Shopping Script 4.1 Cross Site Scripting

Exploit Title : IrIran Shoping Script Cross Site Scripting Vulnerability Exploit Author : Persian Hack Team Vendor Homepage : http://www.iriran.net/eshopbuilder/ Google Dork : "Powered by: IRIran.net" Date: 2016/04/26 Category: Webapps Tested on: Win /php Version : 4.1 PoC: Search Box Vulnerable ...

Axil CMS 3.0 Cross Site Scripting

Exploit Title : Axil CMS 3.0 Cross Site Scripting Exploit Author : Persian Hack Team Vendor Homepage : http://www.axilcreations.com/ Date: 2016/03/31 Version : 3.0 PoC: Search Box Vulnerable To XSS Payload = "Hacked By D: Demo : http://www.excelsior.edu.np/ http://jmeremit.com.np/ http://nrnil.co...

jspxcms admin backend login page cross-site scripting vulnerability

jspxcms is an open source, Java-based content management system CMS. A cross-site scripting vulnerability exists in the administration backend login page of jspxcms version v5.2.4, due to analyzing the search box on the front page of Jspxcms for user inputs that are not input filtered. This...

Zaption: XSS - Gallery Search Listing

HI. If you upload video having title with XSS payload. and search for the video, the dropdown listing will execute the payload. https://www.zaption.com/gallery/search?q=%3E%3Cimg I need not to upload the payload, I utilized already uploaded videos. You can also execute the payload by just start...

KnowledgeTree 3.5.2 Community Edition Permanent XSS Vulnerability

No description provided by source. Exploit Title: KnowledgeTree 3.5.2 Community Edition Permanent XSS Vulnerability Date: 2010-08-11 Author: fdisk @fdiskyou e-mail: fdiskyou at deniable.org Software Link: http://www.knowledgetree.com/products/community/download Version: 3.5.2 Notes: Fixed in the...

Ecmall a built Station template, search box SQL injection-vulnerability warning-the black bar safety net

http://www.tuutao.com/index.php soil Amoy network With the Ecmall of the establishment of the station template, this template should be all pass to kill. There is a search box injection, the injection point is: http://www.tuutao.com/index.php?app=store&act=search&id=4 5&keyword=aaa&minprice=1 0...

Ecmall某建站模板搜索框SQL注射

简要描述： SQL注射 详细说明： http://www.tuutao.com/index.php 土淘网 用的Ecmall的建站模板，用过这个模板的应该都通杀了吧 存在搜索框注入，注入点为： http://www.tuutao.com/index.php?app=store&act=search&id=45&keyword=aaa&minprice=100&maxprice=10000 首先将获取get传来的参数，然后组合到一个sql查询语句condition中： 1.search.app.php中的这段代码就是构建查询min和max价格的sql代码，没有过滤： / 取得查询条件语句...