CVE-2017-11586: URL Redirection to Untrusted Site

dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...

CVE-2017-10993

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal...

PT-2017-11667

Name of the Vulnerable Software and Affected Versions Contao versions prior to 3.5.28 Contao versions 4.x prior to 4.4.1 Description The issue allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL. This can be exploited by a logged-in back-end...

CVE-2017-8896

ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters...

A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter

More info at https://contao.org/en/news/contao-441.html...

A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter

More info at https://contao.org/en/news/contao-441.html...

A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter

More info at https://contao.org/en/news/contao-3528.html...

PHP file inclusion in the back end

Date : 2017-07-12 CVE ID : CVE-2017-10993 Description A logged in back end user can include arbitrary PHP files by manipulating an URL parameter. Since Contao does not allow to upload PHP files in the file manager, the attack is limited to the existing PHP files on the server. Affected versions...

encommun.stm.info XSS vulnerability

Open Bug Bounty ID: OBB-262500 Description| Value ---|--- Affected Website:| encommun.stm.info Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

stihlse.com XSS vulnerability

Vulnerable URL: http://www.stihlse.com/account/periodbal.php?per=1"...

ranguitars.com XSS vulnerability

Vulnerable URL: http://ranguitars.com/index.php/hate?artist=1"...

perseus.tufts.edu XSS vulnerability

Vulnerable URL: http://www.perseus.tufts.edu/hopper/morph?l=1"...

cocopsych.org XSS vulnerability

Vulnerable URL: http://www.cocopsych.org/index.php?Target=practice=search.php=1"...

brownsnursery.com XSS vulnerability

Vulnerable URL: http://www.brownsnursery.com/doptg/index.php?galleryid=1/-///'/"//--...

Inflection: XSS at https://app.goodhire.com/member/GH.aspx

Unescaped input from a URL parameter in the checkout flow was being used as a JavaScript variable for determining what cart contents to render. By manipulating the URL parameter, the researcher was able to execute arbitrary JavaScript on the page...

MapsMarker.com e.U.: Cross-site Scripting (XSS) in /updates-pro/archive/

Hey guys. The dir parameter on /updates-pro/archive/ seems to be vulnerable to Cross-site Scripting. Steps to reproduce: 1- Navigate to: https://www.mapsmarker.com/updates-pro/archive/?dir=v3.0.1 2- Add this to the url: 3- Result in attached printsceen. Or quite simple visit:...

CVE-2017-7343

An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter...

Open redirect

An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter...

CVE-2017-7343: URL Redirection to Untrusted Site

An open redirect vulnerability in Fortinet FortiPortal 4.0.0 and below allows attacker to execute unauthorized code or commands via the url parameter...

PT-2017-17675

Name of the Vulnerable Software and Affected Versions FortiPortal versions 4.0.0 and below Description The issue allows an attacker to execute unauthorized code or commands via the url parameter. This is due to an open redirect vulnerability. Recommendations For FortiPortal versions 4.0.0 and...