Cross site scripting

The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the categoryname parameter in the /admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1...

Chained Quiz < 1.2.7.2 - Authenticated Stored Cross Site Scripting

The plugin does not properly sanitize or escape inputs in the plugin's settings. PoC Open "Chained Quiz Social Sharing" in the WP admin panel. Under title field enter the payload : " Click on Save All Setting and the XSS will fire every time the Social Sharing page is loaded...

Chained Quiz < 1.2.7.2 - Authenticated Stored Cross Site Scripting

The plugin does not properly sanitize or escape inputs in the plugin's settings. Open "Chained Quiz Social Sharing" in the WP admin panel. Under title field enter the payload : "alertdocument.domain Click on Save All Setting and the XSS will fire every time the Social Sharing page is loaded...

CVE-2021-38143

An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when...

Cross site scripting

An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when...

CVE-2021-38143

CVE-2021-38143 (Form Tools) affects Form Tools up to version 3.0.20. An issue allows stored XSS: when an administrator creates a customer account, the customer can log in and change the name/last name fields; these fields are vulnerable to XSS payload insertion and the attack is triggered in the ...

S-CMS 跨站脚本漏洞

S-CMS is a PHP and MySQL based Content Management System CMS from China-based S-CMS. A security vulnerability exists in S-CMS, which stems from a cross-site scripting XSS vulnerability in v1.0 of S-CMS. The vulnerability can be exploited to execute arbitrary code via the component's admin tpl.php...

CVE-2020-18467

Cross Site Scripting XSS vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create...

WP Domain Redirect <= 1.0 - Authenticated SQL Injection

The Edit domain functionality in the plugin has an editid parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. POST /wp-admin/admin.php?page=add&action=edit&id=1 HTTP/1.1 Content-Length: 102 Cache-Control: max-age=0...

CVE-2021-38755

Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php...

CVE-2021-38755

Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php...

CVE-2021-38755

Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php...

NetGear D1500 V1.0.0.21_1.0.1PE - (Wireless Repeater) Stored Cross-Site Scripting Vulnerability

Exploit Title: NetGear D1500 V1.0.0.211.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting XSS Exploit Author: Securityium Vendor Homepage: https://www.netgear.com/ Version: V1.0.0.211.0.1PE Tested on: NetGear D1500 Home Router Contact: email protected Version : Hardware version:...

NetGear D1500 V1.0.0.21_1.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting (XSS)

Exploit Title: NetGear D1500 V1.0.0.211.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting XSS Date: 21 Dec 2018 Exploit Author: Securityium Vendor Homepage: https://www.netgear.com/ Version: V1.0.0.211.0.1PE Tested on: NetGear D1500 Home Router Contact: [email protected] Version :...

NetGear D1500 1.0.0.21_1.0.1PE Cross Site Scripting

Exploit Title: NetGear D1500 V1.0.0.211.0.1PE - 'Wireless Repeater' Stored Cross-Site Scripting XSS Date: 21 Dec 2018 Exploit Author: Securityium Vendor Homepage: https://www.netgear.com/ Version: V1.0.0.211.0.1PE Tested on: NetGear D1500 Home Router Contact: [email protected] Version :...

CVE-2021-37367

CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. Because The file "blcategorieshelp.php" is vulnerable to directory traversal, an attacker can create a file that contains scripts and run arbitrary commands...

CVE-2021-37367

CTparental before 4.45.07 is affected by a code execution vulnerability in the CTparental admin panel. Because The file "blcategorieshelp.php" is vulnerable to directory traversal, an attacker can create a file that contains scripts and run arbitrary commands...

CVE-2021-37366

CTparental before 4.45.03 is vulnerable to cross-site request forgery CSRF in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link that cancels the filtering for all standard users...

CVE-2021-37366

CTparental before 4.45.03 is vulnerable to cross-site request forgery CSRF in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link that cancels the filtering for all standard users...

Cross site request forgery (csrf)

CTparental before 4.45.03 is vulnerable to cross-site request forgery CSRF in the CTparental admin panel. By combining CSRF with XSS, an attacker can trick the administrator into clicking a link that cancels the filtering for all standard users...