5127 matches found
AeroCMS 0.0.1 Cross Site Scripting Vulnerability
AeroCMS-Comment-StoredXSS-POC Author: D4rkP0w4r Note = Don't need register or login account Description = StoredXSS at comment box Step to Reproduct Click Read More - input payload at Author - click Submit button Exploit Input payload at Author - click Submit button When admin login to admin pane...
AeroCMS 0.0.1 Shell Upload Exploit
AeroCMS-Unrestricted-File-Upload-POC Author: D4rkP0w4r Description = Upload web shell at Post Image in admin panel Step to Reproduct Login to admin panel - Posts - Add Posts - Post Image - upload malicious file shell.php - access /images/shell.php on url - shell.php page Exploit When upload succe...
Ecommerce-Website 代码问题漏洞
Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql.Ecommerce-Website is vulnerable to file uploads, which can be exploited by attackers to execute arbitrary code via carefully crafted PHP files...
Server Side Template Injection
Description Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system. PoC video. Proof of Concept Payload: 'cat\x20/etc/passwd'|filter'system' 1. With an authenticated user,...
CVE-2021-43432
A Cross Site Scripting XSS vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp...
CVE-2021-43432
A Cross Site Scripting XSS vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp...
CVE-2021-43432
A Cross Site Scripting XSS vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp...
Cross site scripting
A Cross Site Scripting XSS vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp...
CVE-2021-43432
A Cross Site Scripting XSS vulnerability exists in Exrick XMall Admin Panel as of 11/7/2021 via the GET parameter in product-add.jsp...
CVE-2021-43432
The CVE-2021-43432 entry concerns an XSS vulnerability in the Exrick XMall Admin Panel, exploitable via a GET parameter on the product-add.jsp page. Affected software is Exrick XMall Admin Panel; the vulnerability arises from improper handling of user-supplied input in that JSP, enabling script e...
PT-2022-11836 · Unknown · Exrick Xmall Admin Panel
Name of the Vulnerable Software and Affected Versions: Exrick XMall Admin Panel affected versions not specified Description: A Cross Site Scripting XSS issue exists in the Exrick XMall Admin Panel, specifically via the GET parameter in the product-add.jsp page. This allows for potential malicious...
Exrick XMall 跨站脚本漏洞
Exrick XMall is a distributed e-commerce shopping mall based on SOA architecture. A security vulnerability exists in the Exrick XMall Admin Panel, which originates from a GET parameter in product-add.jsp...
Ecommerce-Website 代码问题漏洞
Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. v1.1.0 of Ecommerce-Website is vulnerable to a file upload vulnerability, which stems from a lack of file upload restrictions in public/admin/index.php?addproduct The vulnerability is caused...
Page Restriction WordPress < 1.2.7 - Admin+ Stored Cross-Site Scripting
The plugin allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator users. In Page/Post Access tab, Use XSS Payload as "alert'XSS' in any of the pages available. XSS wi...
CSZ CMS 1.2.9 - Multiple Blind SQL injection (Authenticated) Vulnerability
Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Blind SQLiAuthenticated Exploit Author: Rahad Chowdhury Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.2.9.zip Version: 1.2.9 Tested on: Windows 10, Kali Linux, PHP 7.4.16, Apache...
CSZ CMS 1.2.9 SQL Injection
Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Blind SQL Injection Authenticated Date: 2021-04-14 Exploit Author: Rahad Chowdhury Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.2.9.zip Version: 1.2.9 Tested on: Windows 10, Kali...
Virtuozzo Hybrid Infrastructure 5.4 Update 1 (5.4.1-59)
This update provides new features, as well as stability fixes for the compute and core storage services. Vulnerability id: VSTOR-62742 A VM creation fails with the error 'Unable to update the attachment.' Vulnerability id: VSTOR-65824 Some charts in the admin panel or Grafana dashboard may be...
Cross site scripting
Maccms v10 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities in /admin.php/admin/art/data.html via the select and input parameters...
Cross site scripting
Maccms v10 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities in /admin.php/admin/website/data.html via the select and input parameters...