CVE-2023-41890

Sustainsys.Saml2 (used to add SAML2P to ASP.NET sites) contains CVE-2023-41890 due to insufficient validation of the IdP issuer when processing a response. This can let a malicious IdP craft a SAML2 response that appears to come from another IdP, and an end user could cause stored AuthenticationP...

brightconnect.com.au Cross Site Scripting vulnerability OBB-3698530

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-42454

SQLpage CVE-2023-42454 affects versions before 0.11.1 where an exposed SQLPage instance stores the database connection string in sqlpage/sqlpage.json and the web_root is the default, allowing an attacker who can access the instance and the database to retrieve credentials and connect directly. Th...

webadmin.sztaki.hu Cross Site Scripting vulnerability OBB-3697384

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

gunlukdemirfiyatlari.net Cross Site Scripting vulnerability OBB-3696478

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

odtec-pieces-quad-onderdelen-atv-parts.com Cross Site Scripting vulnerability OBB-3686354

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-39777

CVE-2023-39777 is a documented XSS vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0, exploitable via the /login.php?do=login URL parameter. The issue is caused by a cross-site scripting flaw that allows an attacker to run arbitrary web scripts or HTML in the context of an aff...

high-st.co.uk Cross Site Scripting vulnerability OBB-3680318

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Red Hat Quay Cross-Site Request Forgery Vulnerability

Red Hat Quay is a distributed container image repository from Red Hat, Inc. that is used to build, distribute, and deploy containers. Red Hat Quay suffers from a security vulnerability that stems from an existing vulnerability in the domain itself or in other domains through the use of techniques...

Night Club Booking Software 1.0 Cross Site Scripting

Title: Night Club Booking Software-1.0 XSS-Reflected Author: nu11secur1ty Date: 09/09/2023 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/night-club-booking-software/sectionDemo Reference: https://portswigger.net/web-security/cross-site-scripting/reflected Description: T...

Webmin Cross-Site Scripting Vulnerability

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version v2.100. An attacker can exploit this vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload...

Fundraising Script 1.0 SQL Injection Vulnerability

Title: Fundraising Script-1.0 SQLi Author: nu11secur1ty Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/fundraising-script/sectionDemo Reference: https://portswigger.net/web-security/sql-injection Description: The cid parameter appears to be vulnerable to SQL injection...

PHP Shopping Cart 4.2 SQL Injection

Title: PHP Shopping Cart-4.2 Multiple-SQLi Author: nu11secur1ty Date: 09/13/2023 Vendor: https://www.phpjabbers.com/ Software:https://www.phpjabbers.com/php-shopping-cart-script/sectionPricing Reference: https://portswigger.net/web-security/sql-injection Description: The id parameter appears to b...

Fundraising Script 1.0 SQL Injection

Title: Fundraising Script-1.0 SQLi Author: nu11secur1ty Date: 09/13/2023 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/fundraising-script/sectionDemo Reference: https://portswigger.net/web-security/sql-injection Description: The cid parameter appears to be vulnerable to...

elviralantenhammer.de Cross Site Scripting vulnerability OBB-3676444

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-5039 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 12.3 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability. If an attacker can convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content m...

The vulnerability of Quarkus’ HTTP security policy allows attackers to circumvent security restrictions, gain unauthorized access to protected information, or cause service failures.

The vulnerability of Quarkus’ HTTP framework policy is related to deficiencies in access control, due to the lack of measures to neutralize the exploitable vulnerabilities. Exploiting this vulnerability allows a malicious actor to bypass security restrictions, gain unauthorized access to protecte...

ullensvang-handel.no Cross Site Scripting vulnerability OBB-3670851

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-41609

CVE-2023-41609 affects CouchCMS v2.3, with an open redirect vulnerability in the sanitize_url() parameter. The issue allows an attacker to redirect a victim user to an arbitrary website via a crafted URL. The vulnerability is described across multiple sources as an open redirect in the sanitize_u...

Wp2Fac - OS Command Injection Exploit

Exploit Title: Wp2Fac v1.0 - OS Command Injection Exploit Author: Ahmet Ümit BAYRAM Vendor: https://github.com/metinyesil/wp2fac Tested on: Kali Linux & Windows 11 CVE: N/A import requests def sendpostrequesthost, revshell: url = f'http://host/send.php' headers = 'User-Agent': 'Mozilla/5.0 X11;...