CVE-2020-35274

DotCMS Add Template with admin panel 20.11 is affected by stored XSS that could let an attacker gain remote privileges and potentially steal cookies. The vulnerability is described as stored XSS in the admin template functionality, enabling a compromise of a website or web application through XSS...

Egavilanmedia User Registration & Login System 跨站请求伪造漏洞

Egavilanmedia User Registration & Login System is a management platform for user registration and login from Egavilanmedia, USA. A cross-site request forgery vulnerability exists in EgavilanMedia User Registration & Login System with Admin Panel 1.0, which allows to remotely obtain privileges to ...

DotCMS Add Template with admin panel Cross-site Scripting Vulnerability

Dotcms dotCMS is a content management system CMS from the American company dotCMS Dotcms. The system supports modules such as RSS feeds, blogs, and forums, and is easy to extend and build. DotCMS Add Template with admin panel 20.11 suffers from a cross-site scripting vulnerability that allows...

S-cart Cross-Site Scripting Vulnerability

S-cart is a Php-based e-commerce management platform for the S-cart community. A cross-site scripting vulnerability exists in s-cart core before version 4.4, which stems from vulnerability to administration panel cross-site scripting XSS attacks. An attacker can exploit the vulnerability to execu...

Academy-LMS 4.3 - Stored XSS

Exploit Title: Academy-LMS 4.3 - Stored XSS Date: 19/12/2020 Vendor page: https://academy-lms.com/ Version: 4.3 Tested on Win10 and Google Chrome Exploit Author: Vinicius Alves XSS Payload: 1 Access LMS and log in to admin panel 2 Access courses page 3 Open course manager and SEO menu 4 Paste the...

Product update: Virtuozzo Hybrid Infrastructure 4.0 Update 1

This update provides a new feature, as well as bug fixes and improvements. Vulnerability id: VSTOR-38583 A non-admin user is unable to create volumes from the command line. Vulnerability id: VSTOR-38785 Enabled geo-replication on Backup Gateway with an S3 backend may result in a deadlock...

CVE-2020-28456

The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting XSS via the admin panel...

CVE-2020-28456

The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting XSS via the admin panel...

Cross site scripting

The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting XSS via the admin panel...

CVE-2020-28456 Cross-site Scripting (XSS)

The package s-cart/core before 4.4 are vulnerable to Cross-site Scripting XSS via the admin panel...

CVE-2020-28456

The CVE-2020-28456 entry affects s-cart/core before version 4.4, with a Cross-site Scripting (XSS) vulnerability exploitable via the admin panel. The root cause is improper handling of input in the admin interface, enabling injection of client-side code. Impact is client-side script execution, po...

S-cart 跨站脚本漏洞

S-cart is a Php-based e-commerce management platform for the S-cart community. A cross-site scripting vulnerability exists in s-cart core before version 4.4, which stems from vulnerability to administration panel cross-site scripting XSS attacks. An attacker can exploit the vulnerability to execu...

CVE-2020-26253

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Pane...

Design/Logic Flaw

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Pane...

CVE-2020-26253 .dev domains treated as local in Kirby

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Pane...

CVE-2020-26253

CVE-2020-26253 affects Kirby CMS (getkirby/cms) versions prior to 3.3.6 and Kirby Panel prior to 2.5.14, where the admin panel could be accessible when hosted on a .dev domain. The root cause is an installation block that treated .dev domains as local (and potentially failed behind a reverse prox...

Savsoft Quiz 5 Cross Site Scripting

Exploit Title: Savsoft Quiz 5 - 'Skype ID' Stored XSS Exploit Author: Dipak Panchalth3.d1p4k Vendor Homepage: https://savsoftquiz.com Software Link: https://github.com/savsofts/savsoftquizv5 Version: 5 Tested on Windows 10 Attack Vector: This vulnerability can results attacker to inject the XSS...

Kirby Access Control Error Vulnerability

Kirby is a file-based content management system CMS. A security vulnerability exists in Kirby CMS versions prior to 3.3.6 and Kirby Panel versions prior to 2.5.14, which stems from the fact that the admin panel may be accessible if hosted in a .dev domain. To protect new installations on public...

Savsoft Quiz 5 - 'Skype ID' Stored XSS

Exploit Title: Savsoft Quiz 5 - 'Skype ID' Stored XSS Exploit Author: Dipak Panchalth3.d1p4k Vendor Homepage: https://savsoftquiz.com Software Link: https://github.com/savsofts/savsoftquizv5 Version: 5 Tested on Windows 10 Attack Vector: This vulnerability can results attacker to inject the XSS...

Savsoft Quiz 5 Cross Site Scripting

Exploit Title: Savsoft Quiz 5 - 'fieldtitle' Stored Cross-Site Scripting Date: 2020-09-02 Exploit Author: Dhruv Pateldhruvp111296 Vendor Homepage: https://savsoftquiz.com/ Software Link: https://github.com/savsofts/savsoftquizv5.git Version: 5.0 Tested on: Windows 10 Attack vector: This...