5127 matches found
CVE-2020-24609
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie v...
CVE-2020-24609
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie v...
CVE-2020-24609
Savsoft Quiz 5.5 and earlier is affected by CVE-2020-24609 (Stored XSS). The vulnerability resides in the User Registration flow, where an attacker can inject a payload that triggers when the admin visits the Manage Users page, enabling cookie theft. Multiple connected sources corroborate a store...
PT-2020-15764 · Savsoft · Savsoft Quiz
Name of the Vulnerable Software and Affected Versions: Savsoft Quiz versions 5.5 and earlier Description: The issue allows an attacker to inject a malicious payload in the User Registration section. When the admin visits the manage user section from the admin panel, the payload triggers, enabling...
Savsoft Quiz 5 - Stored Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Savsoft Quiz 5 - Stored Cross-Site Scripting Exploit Author: Mayur Parmarth3cyb3rc0p Vendor Homepage: https://savsoftquiz.com/ Software Link: https://github.com/savsofts/savsoftquizv5.git Version: 5.0 Tested on: Windows 10...
XenForo 2.1.10 Patch 2 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: XenForo v2.1.10 Patch 2 Stored XSS Author: Vincent666 ibn Winnie Software Link: https://xenforo.com/demo/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog :https://pentest-vincent.blogspot.com/ PoC...
vBulletin 5.6.2 Persistent Cross Site Scripting
Exploit Title: vBulletin 5.6.2 Stored XSS Date:15.08.2020 Author: Vincent666 ibn Winnie Software Link: https://www.vbulletin.com/en/features/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog : https://pentest-vincent.blogspot.com/ PoC:...
Savsoft Quiz 5 - Stored Cross-Site Scripting
Exploit Title: Savsoft Quiz 5 - Stored Cross-Site Scripting Date: 2020-07-28 Exploit Author: Mayur Parmarth3cyb3rc0p Vendor Homepage: https://savsoftquiz.com/ Software Link: https://github.com/savsofts/savsoftquizv5.git Version: 5.0 Tested on: Windows 10 Contact:...
XenForo 2.1.10 Patch 2 Cross Site Scripting
Exploit Title: XenForo v2.1.10 Patch 2 Stored XSS Date:16.08.2020 Author: Vincent666 ibn Winnie Software Link: https://xenforo.com/demo/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog :https://pentest-vincent.blogspot.com/ PoC...
New Relic: One Click Remote Code Injection - *.blog.newrelic.com
With some social engineering, a WordPress admin could be convinced to click a malicious link to abuse a vulnerability in a WordPress plugin. This could lead to script execution or even code execution on the host. Vulnerability: A CSRF vulnerability has been found inside the Admin Panel leading to...
lemlist: app.lemlist.com : Admin Panel Access
hi team, Steps To Reproduce: While doing some analyse for javascript files in app.lemlist.com i found interesting endpoints . is the admin panal and is not protected , any normal user can access the panel . Steps To Reproduce: Add details for how we can reproduce the issue 1. Log into your accoun...
Acronis: Administrative access to development deployment of web service due to auto-filled credentials
It was possible to gain administrative permissions on https://admin.acronis.host due to auto-filled credentials. The service was used for development purposes only and did not contain any sensitive data or data of real users. Summary: I discovered an Acronis admin panel which auto filled...
Acronis: SQL injection on admin.acronis.host development web service
Summary: I found an Acronis domain and started hunting on it. During my hunting, I found an admin panel and was able to access this panel separate report inbound. It was easy to gain access to this panel, and I was not sure if it was for testing purposes or a genuine admin panel. I played around...
User Registration And Login And User Management System 2.1 SQL Injection
Exploit Title: User Registration & Login and User Management System With admin panel - Authentication Bypass Date: 2020-07-04 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...
Product update: Virtuozzo Hybrid Server 7.0 Update 14 Hotfix 1 (7.0.14-257)
The Hotfix 1 for Virtuozzo Hybrid Server 7.0 Update 14 provides stability and usability bug fixes. Vulnerability id: PSBM-105022 Unable to live-migrate VMs with dirty bitmaps on Virtuozzo Storage. Vulnerability id: PSBM-104631, PSBM-104632 CS journals to be placed on SSDs are now properly handled...
Authorization Bypass
magento/community-edition is vulnerable to authorization bypass. The vulnerability exists as its defense-in-depth security mitigation does not restrict unauthorized access to the admin panel...
CVE-2020-9591
Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel...
CVE-2020-9591
Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel...
CVE-2020-9591
CVE-2020-9591 concerns Magento’s defense-in-depth security mitigation vulnerability that could allow unauthorized access to the admin panel. Affected versions include Magento 2.3.4 and earlier, 2.2.11 and earlier, 1.14.4.4 and earlier, and 1.9.4.4 and earlier. The connected documents consistently...