Algolia: Reflected XSS

XSS triggered by specific search query that needed to be inserted manually into the impacted element. The issue was detected as part of ongoing penetration test and despite this report being later than the initial disclosure, bounty has been awarded. Thanks @Algolia , @adams for Fixing this Bug...

falke.com XSS vulnerability

Vulnerable URL: http://www.falke.com/dede/search?query=1zqjqe...

bk55.ru XSS vulnerability

Vulnerable URL: http://bk55.ru/search/?query=...

belpernews.co.uk XSS vulnerability

Vulnerable URL: http://www.belpernews.co.uk/search?query=rihanna+is+pretty+good=%22prompt%22OPENBUGBOUNTY%22%22 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1659058 VIP website...

mz-web.de XSS vulnerability

Vulnerable URL: http://www.mz-web.de/action/mz-web/4484314/search?query=...

udt.ru XSS vulnerability

Vulnerable URL: http://udt.ru/search/?q=%22%3E%3C%2Fscript%3E%3Cimg+src%3Dx+onerror%3Dprompt%2FXSSPOSED%2F%3E=%D0%9F%D0%BE%D0%B8%D1%81%D0%BA Details: Description| Value ---|--- Patched:| Yes, at 22.05.2017 Latest check for patch:| 22.05.2017 03:08 GMT Vulnerability type:| XSS Vulnerability status...

janes.com XSS vulnerability

Vulnerable URL: http://www.janes.com/article/search?query=...

CVE-2016-2040

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 table name, 2 SET value, 3 search query, or 4 hostname in a Location header...

DEBIAN-CVE-2016-2040

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 table name, 2 SET value, 3 search query, or 4 hostname in a Location header...

CVE-2016-2040

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 table name, 2 SET value, 3 search query, or 4 hostname in a Location header...

CVE-2016-2040

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 table name, 2 SET value, 3 search query, or 4 hostname in a Location header...

CVE-2016-2040

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 table name, 2 SET value, 3 search query, or 4 hostname in a Location header...

CVE-2016-2040: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 table name, 2 SET value, 3 search query, or 4 hostname in a Location header...

PT-2016-4981

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 4.0.x through 4.0.10.12 phpMyAdmin versions 4.4.x through 4.4.15.2 phpMyAdmin versions 4.5.x through 4.5.3 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via various means,...

phpmyadmin -- Multiple XSS vulnerabilities

The phpMyAdmin development team reports: With a crafted table name it is possible to trigger an XSS attack in the database search page. With a crafted SET value or a crafted search query, it is possible to trigger an XSS attacks in the zoom search page. With a crafted hostname header, it is...

hyattregistry.com XSS vulnerability

Vulnerable URL: http://www.hyattregistry.com/search?query=1'%22%26%25promptString.fromCharCode88,83,83,80,79,83,69,68...

cointelegraph.co.za XSS vulnerability

Vulnerable URL: http://cointelegraph.co.za/search?query=%22%3E%3Csvg%2Fonload%3Dalert%28%2FXSSPOSED%2F%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

recettes.net XSS vulnerability

Vulnerable URL: http://www.recettes.net/recherche.php?query=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FXSSPOSED%2F%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 264018 Googl...

shop.bild.de XSS vulnerability

Vulnerable URL: http://shop.bild.de/app/navigation.do?action=Search=...

bcdb.com XSS vulnerability

Vulnerable URL: http://www.bcdb.com/bcdb/search.cgi?query=Search%20BC%22%3E%3Cimg%20src=x%20onerror=prompt%28/XSSPOSED/%29%3EDB...&bool=and&substring=1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly...