CVE-2015-3362: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title...

PT-2015-6183

Name of the Vulnerable Software and Affected Versions Drupal Video module versions prior to 7.x-2.11 Description A cross-site scripting XSS issue exists in the Video module for Drupal. This occurs when the video WYSIWYG plugin is used, allowing remote authenticated users to inject arbitrary web...

PT-2015-6197

Name of the Vulnerable Software and Affected Versions Drupal Quizzler module versions prior to 7-x.1.16 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via a node title. Recommendations For versions prior to 7-x.1.16,...

PT-2015-6169

Name of the Vulnerable Software and Affected Versions Cloudwords for Multilingual Drupal module versions prior to 7.x-2.3 Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML. This is achieved...

PT-2015-6206

Name of the Vulnerable Software and Affected Versions Drupal Node Access Product module affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via a node title. Recommendations At the moment,...

CVE-2015-3361: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Linkit module before 7.x-2.7 and 7.x-3.x before 7.x-3.3 for Drupal, when the node search plugin is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a node title...

PT-2015-6182

Name of the Vulnerable Software and Affected Versions Drupal Linkit module versions prior to 7.x-2.7 and versions prior to 7.x-3.3 Description A cross-site scripting XSS issue exists when the node search plugin is enabled, allowing remote authenticated users to inject arbitrary web script or HTML...

PT-2015-6212

Name of the Vulnerable Software and Affected Versions Drupal Ajax Timeline module versions prior to 7.x-1.1 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a node title, which can lead to cross-site scripting XSS attacks. Recommendations For...

CVE-2015-3344: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Course module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3348: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3372: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3387: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Taxonomy Tools module before 7.x-1.4 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via a 1 node or 2 taxonomy term title...

PT-2015-6165

Name of the Vulnerable Software and Affected Versions Drupal Course module versions 6.x-1.x before 6.x-1.2 Drupal Course module versions 7.x-1.x before 7.x-1.4 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via a node title...

PT-2015-6193

Name of the Vulnerable Software and Affected Versions Drupal Node Invite module versions prior to 6.x-2.5 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a node title, which can lead to cross-site scripting XSS attacks. Recommendations For versio...

CVE-2015-3392: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Ajax Timeline module before 7.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3376: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Quizzler module before 7-x.1.16 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

Wolf CMS 0.8.2 Shell Upload

,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit Title : Wolf CMS Arbitrary File Upload Exploit Date : 16 April...

OrangeHRM /index.php/admin/saveJobTitle jobTitleId parameter cross-site scripting vulnerability

OrangeHRM is an open source human resource management tools , features include employee data management , employee self-service system , attendance , allowances and recruitment and other functions . OrangeHRM has a cross-site scripting vulnerability , due to /index.php/admin/saveJobTitle function...

NetCat CMS 3.12 HTML Injection

NetCat CMS 3.12 HTML Injection Security Vulnerabilities Exploit Title: NetCat CMS 3.12 /catalog/search.php? q Parameter HTML Injection Security Vulnerabilities Product: NetCat CMS Content Management System Vendor: NetCat Vulnerable Versions: 3.12 3.0 2.4 2.3 2.2 2.1 2.0 1.1 Tested Version: 3.12...

Opoint Media Intelligence Open Redirect

Opoint Media Intelligence Unvalidated Redirects and Forwards URL Redirection Security Vulnerabilities Exploit Title: Opoint Media Intelligence click.php? &noblink parameter URL Redirection Security Vulnerabilities Vendor: Opoint Product: Opoint Media Intelligence Vulnerable Versions: Tested...