Cross-site Scripting (XSS)

Mozilla is vulnerable to cross-site scripting XSS. It does not handle the parameters provided through title and textarea elements using innerHTML, allowing an attacker to inject arbitrary scripts through it...

WordPress Photo Gallery 1.5.34 SQL Injection

Exploit Title: WordPress Plugin Photo Gallery by 10Web Add new and in add galleries / Gallery groups. GET request going with parameter albumid is vulnerable to Time Based Blind SQL injection. Following is the POC, 1...

Limesurvey cross-site scripting vulnerability (CNVD-2019-31355)

limesurvey is an open source online questionnaire program with multiple functions such as questionnaire design, modification, release, recovery and statistics. A stored cross-site scripting vulnerability exists in Limesurvey versions prior to 3.17.14. An attacker can exploit this vulnerability to...

CVE-2019-16147

Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journalarticle/page.jsp in journal/journal-taglib...

PT-2019-14552 · Limesurvey · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey versions prior to 3.17.14 Description: The issue allows for stored XSS, enabling an attacker to escalate privileges from a low-privileged account to a higher-privileged one, such as SuperAdmin. This is achieved by creating a survey...

CVE-2019-16172: Improper Neutralization of Input During Web Page Generation

LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion...

Mozilla: XSS by breaking out of title and textarea elements using innerHTML

Some HTML elements, such as title and textarea, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if...

UBUNTU-CVE-2019-11744

Some HTML elements, such as title and textarea, can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements, and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if...

OKLite 1.2.25 Arbitrary File Deletion Vulnerability

OKLite is a business building system. OKLite 1.2.25 arbitrary file deletion vulnerability, an attacker can modify the title parameter to exploit the vulnerability to delete arbitrary files...

WordPress Event Tickets 4.10.7.1 CSV Injection

Exploit Title: WordPress Plugin Event Tickets = 4.10.7.1 - CSV Injection Google Dork: inurl:"\wp-content\plugins\event-tickets" Date: 09-01-2019 Exploit Author: MTK http://mtk911.cf/ Vendor Homepage: https://tri.be/ Software Link: https://downloads.wordpress.org/plugin/event-tickets.4.10.7.1.zip...

Wolters Kluwer TeamMate 3.1 - Cross-Site Request Forgery

Hello, Please find the below vulnerability details, --------------------------------------------------------------------------------------------------------------------------------- Exploit Title: Wolters Kluwer TeamMate+ – Cross-Site Request Forgery CSRF vulnerability Date: 02/09/2019 Exploit...

SQL Server Password Changer 1.90 - Denial of Service Exploit

Exploit Title: SQL Server Password Changer v1.90 Denial of Service Exploit Vendor Homepage:https://www.top-password.com/ Exploit Author: Velayutham Selvaraj & Praveen Thiyagarayam TwinTech Solutions Tested Version: v2.10 Tested on: Windows 8 x64 Windows 7 x64 1.- Run python code :Outlook Password...

CVE-2019-15782

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

Cross site scripting

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

CVE-2019-15782

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

CVE-2019-15782: Improper Neutralization of Input During Web Page Generation

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure User...

GNUBOARD5 Cross-Site Scripting Vulnerability (CNVD-2020-20392)

GNUBOARD5 is a Web forum system based on PHP and MySQL. A cross-site scripting vulnerability exists in GNUBOARD5 versions prior to 5.3.2.0. The vulnerability can be exploited by remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter...

CVE-2018-18668

GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/configformupdate.php cftitle parameter...

CVE-2018-18668: Improper Neutralization of Input During Web Page Generation

GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/configformupdate.php cftitle parameter...