8156 matches found
CVE-2019-15483
Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...
Cross site scripting
Bolt before 3.6.10 has XSS via an image's alt or title field...
CVE-2019-15484
Bolt before 3.6.10 has XSS via an image's alt or title field...
PT-2019-14213
Name of the Vulnerable Software and Affected Versions Bolt versions prior to 3.6.10 Description The issue allows for XSS attacks through an image's alt or title field. Recommendations For versions prior to 3.6.10, update to version 3.6.10 or later to resolve the issue...
CVE-2019-15483: Improper Neutralization of Input During Web Page Generation
Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...
CoreFTP Server MDTM Directory Traversal
Exploit Title: CoreFTP Server FTP / SFTP Server v2 - Build 674 MDTM Directory Traversal Metasploit Google Dork: N/A Date: 8/21/2019 Exploit Author: Kevin Randall Vendor Homepage: https://www.coreftp.com Software Link: http://www.coreftp.com/server/index.html Version: Firmware: CoreFTP Server FTP ...
CVE-2019-15484: Improper Neutralization of Input During Web Page Generation
Bolt before 3.6.10 has XSS via an image's alt or title field...
CVE-2019-14795
The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...
PT-2019-13840
Name of the Vulnerable Software and Affected Versions Toggle The Title plugin version 1.4 Description The issue concerns a problem with the Toggle The Title plugin for WordPress. It is possible to exploit this issue via the wp-admin/admin-ajax.php endpoint, specifically through the action=update...
CVE-2019-14795: Improper Neutralization of Input During Web Page Generation
The toggle-the-title aka Toggle The Title plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=updatetitleoptions isAutoSaveValveChecked or isDisableAllPagesValveChecked parameter...
Best Soft Inc.(BSI) Advance Hotel Booking System Cross-Site Scripting Vulnerability
Best Soft Inc.BSI Advance Hotel Booking System is a hotel online booking system from Best Soft India. The system offers modules for hotel booking, room search and discount coupons. A cross-site scripting vulnerability exists in the bookingdetails.php script in the Best Soft Inc. BSI Advance Hotel...
ABC2MTEX 1.6.1 Stack Overflow
Exploit Title: ABC2MTEX 1.6.1 - Command Line Stack Overflow Date: 2019-08-13 Exploit Author: Carter Yagemann Vendor Homepage: https://abcnotation.com/abc2mtex/ Software Link: https://github.com/mudongliang/source-packages/raw/master/CVE-2004-1257/abc2mtex1.6.1.tar.gz Version: 1.6.1 Tested on:...
Joomla JS Support Ticket 1.1.6 Arbitrary File Deletion
Exploit Title: Joomla! component comjssupportticket - Authenticated Arbitrary File Deletion Dork: inurl:"index.php?option=comjssupportticket" Date: 10.08.19 Exploit Author: qw3rTyTy Vendor Homepage: https://www.joomsky.com/ Software Link: https://www.joomsky.com/46/download/1.html Version: 1.1.6...
Joomla JS Support Ticket Component (com_jssupportticket) 1.1.5 - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Joomla! component comjssupportticket - SQL Injection Dork: inurl:"index.php?option=comjssupportticket" Exploit Author: qw3rTyTy Vendor Homepage: https://www.joomsky.com/ Software Link: https://www.joomsky.com/46/download/1.html...
CVE-2019-14549
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible...
dicom-brute NSE Script
Attempts to brute force the Application Entity Title of a DICOM server DICOM Service Provider. Application Entity Titles AET are used to restrict responses only to clients knowing the title. Hence, the called AET is used as a form of password. Script Arguments brute.credfile, brute.delay,...
CVE-2019-14549: Improper Neutralization of Input During Web Page Generation
An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible...
Sar2HTML 3.2.1 - Remote Command Execution Exploit
Exploit for php platform in category web applications Exploit Title: sar2html Remote Code Execution Exploit Author: Furkan KAYAPINAR Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Centos 7 In web application y...
Hardcoded credentials
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board title contents" parameter, aka the adm/boardformupdate.php bomobilesubject parameter...