566 matches found
Cross site scripting
CourseMS aka Course Registration Management System 2.1 is affected by cross-site scripting XSS. When an attacker with access to an Admin account creates a Job Title in the Site area aka the admin/addjobs.php name parameter, they can insert an XSS payload. This payload will execute whenever anyone...
Openlitespeed 1.7.9 - (Notes) Stored Cross-Site Scripting Vulnerability
Exploit Title: Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting Exploit Author: cmOs Vendor Homepage: https://openlitespeed.org/ Software Link: https://openlitespeed.org/kb/install-from-binary/ Version: 1.7.9 Tested on Ubuntu 20.04 Step 1: Log in to the dashboard using the Administrator...
Openlitespeed 1.7.9 Cross Site Scripting
Exploit Title: Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting Date: 3/30/2021 Exploit Author: cmOs Vendor Homepage: https://openlitespeed.org/ Software Link: https://openlitespeed.org/kb/install-from-binary/ Version: 1.7.9 Tested on Ubuntu 20.04 Step 1: Log in to the dashboard using th...
Cross-site Scripting (XSS) - Generic in bigprof-software/online-invoicing-system
✍️ Description A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "filtererclient" Parameter 🕵️♂️ Proof of Concept You can find installation instructions here: https://bigprof.com/appgini/applications/online-invoicing-system Vulnerable...
Cross-site Scripting (XSS) - Generic in bigprof-software/online-invoicing-system
✍️ Description A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "filtereritem" Parameter 🕵️♂️ Proof of Concept You can find installation instructions here: https://bigprof.com/appgini/applications/online-invoicing-system Vulnerable...
TP-Link Cross Site Scripting
============================================================== Unauthenticated Stored Cross-site Scripting in Multiple TP-Link Devices ============================================================== Overview ======== Title:- Unauthenticated Stored Cross-site Scripting in TP-Link Devices. CVE-ID :-...
WordPress MapifyLite 3.3 Cross Site Scripting
Title : MapifyLite Wordpress Plugins Stored XSS Injection Date : 24/03/2021 Author : Eagle Eye Vendor Homepage : https://mapifypro.com/product/mapifylite/ Version Affected : 3.3 and below Tested on : Google Chrome XSS vulnerability from Map settings & locations 1. Login user 2. Go to add map...
Cross-site Scripting (XSS) - Generic in blackcatdevelopment/blackcatcms
✍️ Description 'Display name' Cross Site Scripting XSS 🕵️♂️ Proof of Concept 1. To exploit this vulnerability an attacker has a login in the admin panel and clicks on the admin profile button. Then use " onmouseover=alert1 " this XSS payload on Display name field and click on the Save button. 2...
U.S. Dept Of Defense: Blind Stored XSS on ███████ leads to takeover admin account
Hello Team, I am Hemant Patidar working as a security researcher and I found a bug in your site. Report of bug is as follows:- Vulnerable URL: https://████████/ Description: I have found that various field of the profile page is not properly configured to wipe out HTML tags and Javascript code...
CVE-2020-19762
Automated Logic Corporation ALC WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request...
BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting (XSS)
Exploit Title: BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting XSS Date: 16-02-2021 Exploit Author: Kamaljeet Kumar - TATA Advanced Systems Limited Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Tested on...
BlackCat CMS 1.3.6 - (Display name) XSS Vulnerability
Exploit Title: BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting XSS Exploit Author: Kamaljeet Kumar - TATA Advanced Systems Limited Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Tested on: Windows Steps t...
BlackCat CMS 1.3.6 Cross Site Scripting
Exploit Title: BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting XSS Date: 16-02-2021 Exploit Author: Kamaljeet Kumar - TATA Advanced Systems Limited Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Tested on...
MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting
Exploit Title: MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting Date: 11/28/2018 Author: 0xB9 Software Link: https://github.com/zainali99/trends-widget Version: 1.2 Tested on: Windows 10 1. Description: This plugin shows the most trending threads. Trending thread titles aren't sanitized to...
Cross site scripting
4images Image Gallery Management System 1.7.11 is affected by cross-site scripting XSS in the Image URL. This vulnerability can result in an attacker to inject the XSS payload into the IMAGE URL. Each time a user visits that URL, the XSS triggers and the attacker can be able to steal the cookie...
Collabtive 3.1 Cross Site Scripting
Exploit Title: Collabtive 3.1 - 'address' Persistent Cross-Site Scripting Date: 2021-01-23 Exploit Author: Deha Berkin Bir Vendor Homepage: https://collabtive.o-dyn.de/ Version: 3.1 Tested on: Windows & XAMPP == Tutorial Executed Payloads " onfocus="alert1" autofocus=" HTML Payload == DehaBerkinB...
Nagios XI 5.7.5 Cross Site Scripting
Exploit Title: Nagios XI 5.7.5 - Multiple Persistent Cross-Site Scripting Date: 1-20-2021 Exploit Author: Matthew Aberegg Vendor Homepage: https://www.nagios.com/products/nagios-xi/ Vendor Changelog: https://www.nagios.com/downloads/nagios-xi/change-log/ Software Link:...
Xwiki CMS 12.10.2 Cross Site Scripting
Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting XSS Date: 17-01-2021 Exploit Author: Karan Keswani Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: Xwiki CMS- 12.10.2 Tested on: Windows 10 Description...
Alumni Management System 1.0 - _Last Name field in Registration page_ Stored XSS
Exploit Title: Alumni Management System 1.0 - "Last Name field in Registration page" Stored XSS Exploit Author: Siva Rajendran Date: 2020-12-31 Vendor Homepage: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-source-code.html Software Link:...
