Cross site scripting

Cross Site Scripting XSS vulnerability exists in bludit 3-13-1 via the username in admin/login...

CVE-2021-35323

Cross Site Scripting XSS vulnerability exists in bludit 3-13-1 via the username in admin/login...

CVE-2021-35323

Cross Site Scripting XSS vulnerability exists in bludit 3-13-1 via the username in admin/login...

CVE-2021-35323

Bludit 3.13.1 is affected by a Cross Site Scripting (XSS) vulnerability in the admin/login username field. The root cause is insufficient input sanitization allowing arbitrary JavaScript execution, with potential impact including theft of administrator session cookies or execution of admin action...

CVE-2021-35323: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in bludit 3-13-1 via the username in admin/login...

PT-2021-20885

Name of the Vulnerable Software and Affected Versions: bludit version 3-13-1 Description: A Cross Site Scripting XSS issue exists via the username in the "admin/login" API endpoint. Recommendations: For version 3-13-1, avoid using the username variable in the "admin/login" endpoint until the issu...

PT-2021-19842 · Comodo +1 · Itop +1

Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.6.5 Combodo iTop versions prior to 2.7.5 Description: The issue is related to a XSS vulnerability on the "run query" page when logged in as an administrator. This vulnerability has been resolved in versions...

CVE-2021-24642

The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE via a file upload as well as XSS...

Online DJ Booking Management System 1.0 Cross Site Scripting

Exploit Title: Online DJ Booking Management System 1.0 - 'Multiple' Blind Cross-Site Scripting Date: 2021-10-06 Exploit Author: Yash Mahajan Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/online-dj-booking-management-system-using-php-and-mysql/ Version: V 1.0...

Online DJ Booking Management System 1.0 - 'Multiple' Blind Cross-Site Scripting

Exploit Title: Online DJ Booking Management System 1.0 - 'Multiple' Blind Cross-Site Scripting Date: 2021-10-06 Exploit Author: Yash Mahajan Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/online-dj-booking-management-system-using-php-and-mysql/ Version: V 1.0...

CVE-2020-21504

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php?&m=Public&a=login...

CVE-2020-21504

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php?&m=Public&a=login...

CVE-2021-41286

Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the application, the validity of the password is checked locally. All communication to the database backend is made via the same technical account. Consequently, an attacker can attach a...

Cross-site Scripting (XSS) - Reflected in yeswiki/yeswiki

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execut...

Email Artillery <= 4.1 - Arbitrary File Upload

The plugin does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denyin...

Arbitrary File Upload

Overview shopxo/shopxo is an e-commerce system. Affected versions of this package are vulnerable to Arbitrary File Upload. After logging in as an administrator, you can upload a compressed package carrying malicious files to achieve the purpose of remote code execution. Remediation Upgrade...

Police Crime Record Management System 1.0 - Multiple Stored Cross-Site Scripting Vulnerability

Exploit Title: Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting XSS Exploit Author: Ömer Hasan Durmuş Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html Version: v1.0 Category: Webapps Tested on: Linux/Windows Step ...

WordPress Download Manager < 3.2.13 - Email Template Setting Update via CSRF

The plugin did not have CSRF check in place before saving its Email Template setting, allowing attackers to make a logged in admin change them via a CSRF attack PoC...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php...

CVE-2021-34628

The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the /includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7...