2770 matches found
Design/Logic Flaw
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...
UBUNTU-CVE-2020-4049
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...
CVE-2020-4049
In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...
Online Course Registration 1.0 - Authentication Bypass
Exploit Title: Online Course Registration 1.0 - Authentication Bypass Google Dork: N/A Date: 2020-06-05 Exploit Author: BKpatron Vendor Homepage: https://www.sourcecodester.com/php/14251/online-course-registration.html Software Link:...
CVE-2014-8945
admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields...
Command injection
admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields...
CVE-2014-8941
Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&fromid= or admin.php?page=history&limit= URI...
Shopify: xss stored in https://your store.myshopify.com/admin/
hello , i fond xss stored in https://your store.myshopify.com/admin/ steps ; 1. go to https://swqdewd.myshopify.com/admin/menus/new 2. click in Add menu item 3. add name " AND any link 4. now click add 5. click in remove item 6. alert 7. watch the vedio poc for more information Impact xss attack...
WordPress bbPress plugin cross-site scripting vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. bbPress is a forum plugin used in it. A cross-site scripting vulnerability exists in WordPress bbPress plugin 2.6.4 and...
Command execution vulnerability in SeaCMS backend ad***_pi***.php page
SeaCMS is a station building system based on PHP+MYSQL architecture and supports cross-platform operation. A command execution vulnerability exists in the adpi.php page in the background of SeaCMS. An attacker can exploit the vulnerability to gain control of the server...
CommScope Ruckus ZoneFlex R500 Cross-Site Request Forgery Vulnerability
CommScope Ruckus ZoneFlex R500 is a wireless access point product from CommScope, Inc. A cross-site request forgery vulnerability exists in the login.asp page in the CommScope Ruckus ZoneFlex R500. An attacker could exploit this vulnerability to perform a crawl or other analysis with the SUBCA-1...
WordPress WTI Like Post Cross-Site Scripting Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wti-like-post is a plugin used to add likes to web pages. A cross-site scripting vulnerability exists in the administration page of...
CVE-2020-8799
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website...
CVE-2020-8799
A Stored XSS vulnerability has been found in the administration page of the WTI Like Post plugin through 1.4.5 for WordPress. Once the administrator has submitted the data, the script stored is executed for all the users visiting the website...
Online Course Registration 2.0 SQL Injection
Exploit Title: Online Course Registration 2.0 - Authentication Bypass Google Dork: N/A Date: 2020-04-25 Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-course-registration-free-download/ Version: 2.0 Tested on: Kali Linux...
Online Hotel Booking System Pro <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
An unauthenticated user can inject malicious JavaScript via the booking form, specifically in the new user details.. The XSS payload is then executed when an authenticated administrator user views the booking on the Customer-booking page. Inject XSS via most fields in the booking form, which will...
CVE-2020-6586
Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this, the XSS is triggered...
CVE-2019-11355
An issue was discovered in Poly formerly Polycom HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By...