Blackcat Cms v1.4 - Remote Code Execution (RCE)

Exploit Title: Blackcat Cms v1.4 - Remote Code Execution RCE Application: blackcat Cms Version: v1.4 Bugs: RCE Technology: PHP Vendor URL: https://blackcat-cms.org/ Software Link: https://github.com/BlackCatDevelopment/BlackCatCMS Date of found: 13.07.2023 Author: Mirabbas Ağalarov Tested on: Lin...

“Never Assume Anything” – Unauthenticated Stored Cross-Site Scripting Vulnerability Exposed in 14 Email Logging Plugins

“Never Assume Anything” – that is the 4th Guiding Principle written in the Security section of the WordPress Common APIs Handbook for developers. When it comes to WordPress plugin security, assumptions can be dangerous. This became evident when the Wordfence Threat Intelligence team discovered an...

portal.alignedmodernhealth.com Cross Site Scripting vulnerability OBB-3527762

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

blackboxindustrialsurplus.machines4u.com.au Cross Site Scripting vulnerability OBB-3526690

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

U.S. Dept Of Defense: Blind Sql Injection in https://████████/

A blind SQL injection vulnerability was discovered in the █████████ website. This vulnerability allowed an attacker to bypass authentication and retrieve sensitive information from the database. The vulnerability was successfully exploited using SQLmap, a popular SQL injection tool...

sign114.net Cross Site Scripting vulnerability OBB-3523768

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

www2a.biglobe.ne.jp Cross Site Scripting vulnerability OBB-3523251

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kettenrad.ch Cross Site Scripting vulnerability OBB-3517192

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

roadreadyinspections.com Open Redirect vulnerability OBB-3517084

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

News Portal v4.0 - SQL Injection (Unauthorized) Vulnerability

Exploit Title: News Portal v4.0 - SQL Injection Unauthorized Exploit Author: Hubert Wojciechowski Contact Author: email protected Vendor Homepage: https://phpgurukul.com/news-portal-project-in-php-and-mysql/c Software Link: https://phpgurukul.com/?sdmprocessdownload=1&downloadid=7643 Version: 4.0...

buecherei-mils.webopac.at Cross Site Scripting vulnerability OBB-3516637

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

buecherei-axams.webopac.at Cross Site Scripting vulnerability OBB-3516443

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

nta.p-brain.info Cross Site Scripting vulnerability OBB-3514209

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

buecherei-muehlau.webopac.at Cross Site Scripting vulnerability OBB-3511228

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-37787

Geeklog v2.2.2 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow an attacker to run arbitrary web scripts or HTML by injecting a crafted payload into the Rule and Route parameters of /admin/router.php. Root cause: improper validation of user-supplied input in router.ph...

CVE-2023-37785

ImpressCMS is affected: versions v1.4.5 and earlier. The XSS flaw resides in the smile_code parameter of editprofile.php, caused by insufficient input filtering/escaping. Successful exploitation enables execution of arbitrary web scripts/HTML in a logged-in user context, as described across multi...

web455.webbox333.server-home.org Cross Site Scripting vulnerability OBB-3509370

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mantra - A Tool Used To Hunt Down API Key Leaks In JS Files And Pages

The tool in question was created in Go and its main objective is to search for API keys in JavaScript files and HTML pages. It works by checking the source code of web pages and script files for strings that are identical or similar to API keys. These keys are often used for authentication to...

capweb.srv264.sd-france.net Cross Site Scripting vulnerability OBB-3504317

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-2072

CVE-2023-2072 affects Rockwell Automation PowerMonitor 1000. Stored cross-site scripting in the product’s web pages allows code injection by an unauthenticated attacker to impact an authenticated user, potentially enabling remote code execution and compromising confidentiality, integrity, and ava...