829 matches found
CVE-2021-28002
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page...
Cross site scripting
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page...
CVE-2021-28002: Improper Neutralization of Input During Web Page Generation
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page...
LY Corporation: See drafts and post articles if the account owner hasn't set password (livedoor CMS plugin)
For new accounts that haven't set passwords yet, an attacker is able to see drafts or post articles as victims...
CVE-2021-37393
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...
CVE-2020-19037: Improper Authentication
Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies...
Command Execution Vulnerability in OTCMS (PHP Version)
Nettitanium CMS OTCMS PHP version based on PHP sqlite/mysql technical architecture, UTF-8 coding, not only can be applied to a wide range of news/article publishing type of website, but also applicable to corporate websites. A command execution vulnerability exists in OTCMS PHP version, which can...
awesome-windows-exploitation
This is a curated list of Windows exploitation resources and tools. The repository is a collection of articles, tutorials, and tools for Windows exploitation, including stack overflows, heap overflows, and kernel-based Windows overflows. The list includes resources such as articles from Phrack, a...
Pluck 跨站请求伪造漏洞
Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck CMS version 4.7.9. A remote attacker can exploit this vulnerability to execute arbitrary code and delete specific articles via the component "/admin.php?action=pag...
CMSWing 跨站脚本漏洞
CMSWing is an e-commerce platform and CMS building system based on ThinkJS and MySQL. A cross-site scripting vulnerability exists in CmsWing version 1.3.7, which stems from a vulnerability that is triggered when a visitor accesses the Articles module. No detailed vulnerability details are availab...
CVE-2021-21438 FAQ articles are shown to users without permission
Agents are able to see linked FAQ articles without permissions defined in FAQ Category. This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions...
CVE-2021-21438
Agents are able to see linked FAQ articles without permissions defined in FAQ Category. This issue affects: FAQ version 6.0.29 and prior versions, OTRS version 7.0.24 and prior versions...
Textpattern CMS 4.9.0-dev - (Excerpt) Persistent Cross-Site Scripting Vulnerability
Exploit Title: Textpattern CMS 4.9.0-dev - 'Excerpt' Persistent Cross-Site Scripting XSS Date: 2021-03-04 Exploit Author: Tushar Vaidya Vendor Homepage: https://textpattern.com Software Link: https://textpattern.com/start Version: v 4.9.0-dev Tested on: Windows Steps-To-Reproduce: 1. Login into...
Textpattern CMS 4.9.0-dev - 'Excerpt' Persistent Cross-Site Scripting (XSS)
Exploit Title: Textpattern CMS 4.9.0-dev - 'Excerpt' Persistent Cross-Site Scripting XSS Date: 2021-03-04 Exploit Author: Tushar Vaidya Vendor Homepage: https://textpattern.com Software Link: https://textpattern.com/start Version: v 4.9.0-dev Tested on: Windows Steps-To-Reproduce: 1. Login into...
Cumulative Update 18 for Exchange Server 2016
None None...
What’s up with WhatsApp’s privacy policy?
WhatsApp has been in the news recently after changes to its privacy policy caused a surge of interest in rival messaging app Signal. Initial reports may have worried a lot of folks, leading to inevitable clarifications and corrections. But what, you may ask, actually happened? Is there a problem?...
Zammad Access Control Error Vulnerability
Zammad is a Web-based open source helpdesk/customer support system. An access control error vulnerability exists in Zammad versions prior to 3.5.1. An attacker can exploit this vulnerability to bypass auditing and change Ticket Article data via REST API calls...
Zammad Access Control Bypass Vulnerability
Zammad is a Web-based open source helpdesk/customer support system. An access control bypass vulnerability exists in Zammad versions prior to 3.5.1. An Agent with Customer privileges in a group can exploit this vulnerability to bypass access control to internal Articles via the Ticket detail view...