3021 matches found
laod.cn Open Redirect vulnerability
Open Bug Bounty ID: OBB-311163 Description| Value ---|--- Affected Website:| laod.cn Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...
eveningecho.ie XSS vulnerability
Vulnerable URL: http://www.eveningecho.ie/?s%3D%22%3E%3Csvg%20onload%3Dalert%22OPENBUGBOUNTY%22%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 17.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 221873 VIP website status:| No...
CVE-2017-14509
An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 and Sugar Community Edition 6.5.26. A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a...
supporters.yaf.org XSS vulnerability
Vulnerable URL: http://supporters.yaf.org/events/?filtercategory=supporter-eventssite=1'%22%26%25prompt/OPENBUGBOUNTY/...
Cross-site Scripting (XSS) Through URL Parameter
The Play Framework is vulnerable to cross-site scripting XSS. An XSS vulnerability has been found in Plays URL rendering. This vulnerability allows attackers to insert and execute arbitrary code...
CVE-2015-2749
Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...
Remote file inclusion
PHP remote file inclusion vulnerability in the getfile function in upload/admin2/controller/reportlogs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the filepath parameter to upload/admin2...
Googlemaps Plugin Denial of Service Vulnerability in Joomla!
Joomla! is the U.S. Open Source Matters development team developed a set of open source content management system CMS, it provides RSS feeds, site search and other features. Googlemaps is one of the set of Google Maps plug-ins. A security vulnerability exists in the Joomla! Googlemaps plugin that...
Cross-site Scripting (XSS)
automattic/jetpack is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the URL parameter in sso.php...
Remote code execution
By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...
CVE-2016-4462
CVE-2016-4462 concerns Apache OFBiz. A logged-in user can manipulate the externalLoginKey URL parameter to feed the Freemarker Template Engine with directives reflected on the page, enabling remote code execution via a specially crafted Freemarker template. Mitigation: upgrade to Apache OFBiz 16....
CVE-2016-4462
By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...
GSA Bounty: Content injection via URL parameter.
Hello, The following URL is vulnerable to content & code injection. https://labs.data.gov/dashboard/validate...
MantisBT Cross-Site Scripting Vulnerability (CNVD-2017-28224)
MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in MantisBT versions prior to 1.2.19 and prior to 1.3.0-beta.2. A remote...
Cross site scripting
Cross-site scripting XSS vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalinkpage.php...
Hashtopussy Cross-Site Scripting Vulnerability
Hashtopussy is a cross-platform client-server tool for distributing hash table tasks between multiple computers, featuring portability, stability and multi-user support. A cross-site scripting vulnerability exists in Hashtopussy version 0.4.0. A remote attacker can exploit this vulnerability with...
Synology Photo Station Arbitrary File Download Vulnerability
Synology Photo Station is a Synology solution for sharing pictures, videos and blogs over the Internet. A server-side request forgery vulnerability exists in the fileupload.php file in Synology Photo Station versions prior to 6.7.4-3433 and 6.3-2968. A remote attacker can exploit the vulnerabilit...
CVE-2017-11586
dayrui FineCms 5.0.9 has URL Redirector Abuse via the url parameter in a sync action, related to controllers/Weixin.php...
