Multiple cross-site scripting vulnerabilities in GROWI

Overview GROWI provided by WESEEK, Inc. contains multiple cross-site scripting vulnerabilities listed below. Stored cross-site scripting vulnerability in the UserGroup Management section of admin page CWE-79 - CVE-2018-0652 Stored cross-site scripting vulnerability in Wiki page view CWE-79 -...

ASUS WL-330NUL Cross-Site Request Forgery Vulnerability

The WL-330NUL is a portable wireless LAN router offered by ASUS Japan. The ASUS WL-330NUL suffers from a cross-site request forgery vulnerability that could allow a user to perform unexpected actions on the device if they view a malicious page while logged into the administration screen...

Design/Logic Flaw

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add...

laverastit.fi XSS vulnerability

Open Bug Bounty ID: OBB-638032 Description| Value ---|--- Affected Website:| laverastit.fi Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Other Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

portfolioCMS any.php file upload vulnerability

portfolioCMS is a content management system CMS based on PHP and MySQL. A security vulnerability exists in portfolioCMS version 1.0.5. An attacker can exploit the vulnerability to upload arbitrary .php files with the help of admin/portfolio.php?newpage=true URI...

Cross site scripting

The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...

CVE-2018-11485

The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce - Orders admin page. The attack is possible by modifying the "referralsite" cookie to have an XSS payload, and...

Auto Dealership & Vehicle Showroom WebSys 1.0 - XSS / CSRF / Authentication Bypass Vulnerabiliti

Exploit for php platform in category web applications Exploit Title: Auto Dealership & Vehicle Showroom WebSys 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin panel Authentication bypass Exploit Author: Borna nematzadeh L0RD or email protected Vendor Homepage:...

Superfood 1.0 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Superfood - Restaurants & Online Food Order System 1.0 - Persistent cross site scripting / Cross site request forgery / Admin panel Authentication bypass Date: 2018-05-20 Exploit Author: Borna nematzadeh L0RD or email protected...

Auto Dealership & Vehicle Showroom WebSys 1.0 - Multiple Vulnerabilities

Exploit Title: Auto Dealership & Vehicle Showroom WebSys 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Admin panel Authentication bypass Date: 2018-05-21 Exploit Author: Borna nematzadeh L0RD or [email protected] Vendor Homepage:...

CVE-2018-10737

A SQL injection issue was discovered in Nagios XI before 5.4.13 via the admin/logbook.php txtSearch parameter...

TheDoc - Simple But Very Useful SQLMAP Automator With Built In Admin Finder, Hash Cracker (Using Hashcat) And More!

TheDoc is a simple but very useful SQLMAP automator with built in admin finder, hash crackerusing hashca and more! Abilities: Counts total injections tried. Crawls given domain for vulnerabilties. Extracts Database Infos via injection URL Extract Users, Passwords & emails via injection URL Extrac...

CVE-2018-1000172

Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting XSS vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45...

CVE-2018-10430

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

WordPress User Profile&Membership Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports PHP and MySQL server set up a personal blog site.User Profile&Membership plugin is used in one of the website membership registration plugin. A cross-site scripting...

CVE-2018-10318

Frog CMS 0.9.5 has XSS via the admin/?/page/edit pagekeywords parameter, aka Edit Page Metadata...

CVE-2018-10318

Frog CMS 0.9.5 has XSS via the admin/?/page/edit pagekeywords parameter, aka Edit Page Metadata...

CVE-2018-10318

Frog CMS 0.9.5 contains a cross-site scripting (XSS) vulnerability in the admin/?/page/edit page[keywords] parameter (Edit Page Metadata). The issue arises from user-supplied content in the keywords field that is reflected in the page. Exploitation specifics beyond this description are not provid...

CVE-2018-10318

Frog CMS 0.9.5 has XSS via the admin/?/page/edit pagekeywords parameter, aka Edit Page Metadata...

ChemCMS Cross-Site Request Forgery Vulnerability

ChemCMS is a chemical-based web content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in ChemCMS version 1.0.6. A remote attacker can exploit this vulnerability to add an administrator account via the public/admin/user/addpost.html page...