GetSimple CMS My SMTP Contact 1.1.1 CSRF / Remote Code Execution

Exploit Title: GetSimple CMS My SMTP Contact Plugin = v1.1.1 - CSRF to RCE Exploit Author: Bobby Cooke boku Date: April 15th, 2021 Vendor Homepage: http://get-simple.info Software Link: http://get-simple.info/extend/download.php?file=files/18274/1221/my-smtp-contact1.1.1.zip&id=1221 Vendor:...

U.S. Dept Of Defense: Reflected Xss in [██████]

Description: Reflected XSS in █████████ due to unsanitized single quote '. Impact An attacker could execute arbitrary javascript, and perform malicious actions ! Step-by-step Reproduction Instructions 1. Used payload: simo%27onfocus=%27confirmdocument.domain%27name=%27simo%27simo 2. Visit the url...

Cross-Site Scripting (XSS)

erubis is vulnerable to cross-site scripting XSS. The single quote character ' is not validated and allows a remote attacker to inject and execute arbitrary Javascript in a user's browser via a template source and a malicious XML document...

DEBIAN-CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

DEBIAN-CVE-2019-12525

An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7. When Squid is configured to use Digest authentication, it parses the header Proxy-Authorization. It searches for certain tokens such as domain, uri, and qop. Squid checks if this token's value starts with a quote and ends...

Petraware pTransformer ADC SQL Injection

Exploit Title: Petraware pTransformer ADC before 2.1.7.22827 allows SQL Injection via the User ID parameter to the login form. Date: 28-05-2019 Exploit Author: Faudhzan Rahman Website: https://faudhzanrahman.blogspot.com/ Vendor Homepage: http://www.petraware.com Version: 2.0 CVE : CVE-2019-12372...

CVE-2018-19988

In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without...

Command injection

In the /HNAP1/SetClientInfoDemo message, the AudioMute and AudioEnable parameters are vulnerable, and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code, the AudioMute and AudioEnble parameters are saved in the ShellPath script file without...

OLX: Reflective XSS at olx.ph

Hello, I would like to report a reflective XSS at https://www.olx.ph. Steps to reproduce Visit the following link: https://www.olx.ph/all-results?q=car&utmsource=OptHomepageVar0&utmmedium=Search&utmcampaign=toto%27-alertdocument.domain-%27-%27 An XSS should pop-up F305078 Technical Details The...

Cross-site Scripting (XSS)

Overview erubis is an implementation of eRuby and has the following features: Affected versions of the package are vulnerable to Cross-site Scripting XSS. Single quotes were not properly escaped in the helper.rb and helpers/railshelper.rb files. The Erubis Documentation shows missing escaping...

phpslash <= 0.8.1.1 - Remote Code Execution Exploit

No description provided by source. !/usr/bin/php -q ?php phpslash = 0.8.1.1 Remote Code Execution Exploit - - - - - - - - - - - - - - - - - - - - - - - - - RCE with no special rights guest. No special PHP conditions required. - - - - - - - - - - - - - - - - - - - - - - - - - 0 It was a private...

bluecms the latest version of the double-byte universal password into the background-bug warning-the black bar safety net

Brief description: bluecms the latest version i.e., v1. 6sp1,processing of login authentication when the variables are single quotes escaped, but can be used gbk double-byte coding the closing single quote and then comment to enter the background Detailed description: bluecms verify the login cod...

discuz! 7.* Stored xss-vulnerability warning-the black bar safety net

Post flash at the address filter is not strict, resulting in the storage typexss. ! document. writeACFLRunContent'width', '5 5 0', 'height', '4 0 0', 'allowNetworking', 'internal', 'allowScriptAccess', 'never', 'src', 'aaaaaaaaaaaaa', 'quality', 'high', 'bgcolor', 'ffffff', 'wmode', 'transparent'...

Potential XSS Vulnerability in Ruby on Rails

The HTML escaping code in Ruby on Rails does not escape all potentially dangerous characters. In particular the code does not escape the single quote character. The helpers used in Rails itself never use single quotes, so most applications are unlikely to be vulnerable, however all users running ...

ModSecurity引号解析安全限制绕过漏洞(CVE-2012-2751)

BUGTRAQ ID: 54156 CVE ID: CVE-2012-2751 modsecurity是经常与PHP结合使用的Web应用防火墙。 ModSecurity 2.6.6之前版本结合PHP使用时，没有正确处理单引号，可允许远程攻击者通过带有multipart/form-data Content-Type标头的请求内Content-Disposition字段中的请求参数的单引号，绕过过滤规则并执行诸如XSS攻击。 0 Breach Security modsecurity 2.x 厂商补丁： Breach Security ---------------...

CVE-2009-5031

ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting XSS attacks via a single quote in a request parameter in the Content-Disposition field of a...

CVE-2009-5031

CVE-2009-5031 affects ModSecurity before 2.5.11. It mishandles single quotes in request parameter values in the Content-Disposition header of multipart/form-data requests, allowing remote attackers to bypass filtering and perform other attacks such as XSS. A fix is available in ModSecurity 2.5.11...

CVE-2012-2751

CVE-2012-2751 relates to ModSecurity prior to 2.6.6 when used with PHP. The issue arises in how single quotes in Content-Disposition are handled inside multipart/form-data requests, allowing remote attackers to bypass filtering rules and potentially perform XSS. The vulnerability is noted to exis...

马克斯CMS(Maxcms) admin_inc.asp SQL注入漏洞

在文件admin/ admininc.asp中： Sub checkPower //第103行 dim loginValidate,rsObj : loginValidate = "maxcms2.0" err.clear on error resume next set rsObj=conn.db"select mrandom,mlevel from premanager where musername='"&rCookie"musername"&"'","execute" rCookie函数在文件inc/ CommonFun.asp中 Function rCookiecookieNa...

PYSEC-2010-1

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting XSS protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element...