HTML Injection

github.com/gogits/gogs is vulnerable to HTML injection. The user search API can be used to inject HTML content. An attacker could insert spoofed content to carry out some form of social engineering attack. HTML injection is an attack that is similar to cross-site scripting but does not execute...

Cross-site Scripting (XSS)

concrete5 is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the email parameter in web/concrete/singlepages/dashboard/users/search.php, allowing a malicious user to inject and execute arbitary webscript through it...

CVE-2017-12777

Cross-Site Scripting XSS exists in NexusPHP version v1.5 via some parameter to usersearch.php...

Information Disclosure

Moodle is vulnerable to information disclosure. When remote authenticated users search the posts, it is possible for them to view the names and other details of the arbitrary user accounts...

Multiple SQL Injection Vulnerabilities in Ocean CMS V6.48 Backend

Ocean Movie System aka Ocean CMS seacms is a PHP movie system. Ocean CMS V6.48 backend user search, backend user edit admin\adminmembers.php page id parameter, backend admin\adminmembersgroup.php page $id parameter and admin\admindatarelate.php page $vfield SQL injection vulnerability exists. The...

Critical: java-1.7.0-openjdk

Issue Overview: It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application. Th...

diepresse.com XSS vulnerability

Vulnerable URL: http://diepresse.com/user/search.do Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 7861 VIP website status:| Yes Coordinated Disclosure Timeline: Description| Value...

Critical: java-1.8.0-openjdk

Issue Overview: It was discovered that the RMI registry and DCG implementations in the RMI component of OpenJDK performed deserialization of untrusted inputs. A remote attacker could possibly use this flaw to execute arbitrary code with the privileges of RMI registry or a Java RMI application...

OpenJDK: LdapLoginModule incorrect userDN extraction (JAAS, 8161743)

It was discovered that the JAAS component of OpenJDK did not use the correct way to extract user DN from the result of the user search LDAP query. A specially crafted user LDAP entry could cause the application to use an incorrect DN...

Inout QuerySpace 1.0 Script - Improper Access Restrictions Vulnerability

Exploit for php platform in category web applications Vulnerability: Security Bypass Date: 13.01.2017 Vendor Homepage: http://www.inoutscripts.com/ Script Name: Inout QuerySpace Script Script Version: v1.0 Script Buy Now: http://www.inoutscripts.com/demo/inout-queryspace/demo/ Author: İhsan Şenca...

shinden.pl XSS vulnerability

Vulnerable URL: http://shinden.pl/users?search=666"...

gameforge.com XSS vulnerability

Vulnerable URL: http://gameforge.com/user/search?dummy=...

us.gameforge.com XSS vulnerability

Vulnerable URL: http://us.gameforge.com/user/search?dummy=...

gr.gameforge.com XSS vulnerability

Vulnerable URL: http://gr.gameforge.com/user/search?dummy=...

hu.gameforge.com XSS vulnerability

Vulnerable URL: http://hu.gameforge.com/user/search?dummy=1...

looki.ae XSS vulnerability

Vulnerable URL: http://www.looki.ae/user/usersearch.html?nickname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 11:06 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

looki.us XSS vulnerability

Vulnerable URL: http://www.looki.us/user/usersearch.html?nickname=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 26.07.2017 Latest check for patch:| 26.07.2017 11:05 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

PT-2014-8682 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the q parameter to two API endpoints: "api/v1/repos/search" and...

CVE-2014-5196

Cross-site request forgery CSRF vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in improved-user-search-in-backend.php in the backend in the Improved user search in backend plugin before 1.2.5 for WordPress allows remote attackers to hijack the authentication of administrators for requests that insert XSS sequences via the...