OpenSMTPD < 6.6.3p1 - Local Privilege Escalation / Remote Code Execution Exploit

/ LPE and RCE in OpenSMTPD's default install CVE-2020-8794 Copyright C 2020 Qualys, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or at...

DotNetNuke 9.5 - File Upload Restrictions Bypass

DotNetNuke 9.5 - File Upload Restrictions Bypass Exploit Title: DotNetNuke 9.5 - File Upload Restrictions Bypass Date: 2020-02-23 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link:...

DotNetNuke CMS 9.5.0 File Extension Check Bypass

Exploit Title: File upload vulnerability through bypassing client-side file extension check Date: 23 Feb 2020 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link: https://github.com/dnnsoftware/Dnn.Platform/releases/download/v9.5.0/DNNPlatform9.5.0Install.zip...

DotNetNuke 9.5 - File Upload Restrictions Bypass Vulnerability

Exploit for php platform in category web applications Exploit Title: DotNetNuke 9.5 - File Upload Restrictions Bypass Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link:...

DotNetNuke 9.5 - File Upload Restrictions Bypass

Exploit Title: DotNetNuke 9.5 - File Upload Restrictions Bypass Date: 2020-02-23 Exploit Author: Sajjad Pourali Vendor Homepage: http://dnnsoftware.com/ Software Link: https://github.com/dnnsoftware/Dnn.Platform/releases/download/v9.5.0/DNNPlatform9.5.0Install.zip Version: = 9.5 CVE : N/A More...

NEC Aterm WG2600HS Cross-Site Scripting Vulnerability

The NEC Aterm WG2600HS is a wireless router from Nippon Electric NEC. A cross-site scripting vulnerability exists in the NEC Aterm WG2600HS version 1.3.2, which originates from a WEB application that lacks proper validation of client data. An attacker can exploit the vulnerability to execute...

PrestaShop Cross-Site Scripting Vulnerability (CNVD-2020-13058)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in PrestaShop versions prior to 1.4.11. T...

Synacor Zimbra Collaboration Cross-Site Scripting Vulnerability (CNVD-2020-13200)

Synacor Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A cross-site scripting vulnerability exists in Synacor Zimbra Collaboration versions prior to 8.0.8. The vulnerability stems from the WEB...

Synacor Zimbra Collaboration Cross-Site Scripting Vulnerability (CNVD-2020-13201)

Synacor Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A cross-site scripting vulnerability exists in Synacor Zimbra Collaboration versions prior to 8.6.0 patch5. The vulnerability stems from a...

Razer: Reflected XSS on molpay.com with cloudflare bypass

The tester discovered a reflected XSS vulnerability on molpay.com which could allow an adversary to steal client side information such as a cookie. Razer Fintech thanks the tester for his clear report and PoC. Follow brutelogic for amazing bypass tips. Thank you for bounty @razer 🙏...

Netsweeper Cross-Site Scripting Vulnerability (CNVD-2020-10711)

Netsweeper is a Web content filtering solution from Netsweeper Canada. A cross-site scripting vulnerability exists in the webadmin / policy / grouptableajax.php file in versions of Netsweeper prior to 3.1.10, which stems from a lack of proper validation of client-side data by the WEB application...

Plone Input Validation Error Vulnerability

Plone is an open source content management system CMS built on the Zope application server. A cross-site scripting vulnerability exists in Plone. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-10610)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress suffers from a cross-site scripting vulnerability. The vulnerability stems from the WEB application'...

SilverStripe Cross-Site Scripting Vulnerability (CNVD-2020-10132)

SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . SilverStripe 4.4.5 before version 4.5.x and 4.5.2 before version 4.5.x cross-site...

Cross-Site Scripting Vulnerability in Multiple Microsemi Products

Microsemi Symmetricom SyncServer S100 and others are a network time server from Microsemi, USA. A cross-site scripting vulnerability exists in several Microsemi products. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit...

iTop Cross-Site Scripting Vulnerability (CNVD-2020-10004)

iTop is open source ITIL ITSM software. A cross-site scripting vulnerability exists in iTop 2.6.0 and earlier versions. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Revive Adserver Cross-Site Scripting Vulnerability (CNVD-2020-10427)

Revive Adserver is an open source advertising management system from the Revive Adserver team. The system provides ad placement, ad space management, data statistics and other functions. A cross-site scripting vulnerability exists in Revive Adserver. The vulnerability stems from the lack of prope...

Codoforum cross-site scripting vulnerability (CNVD-2020-14697)

Codoforum is a set of PHP and MySQL based forum software. A cross-site scripting vulnerability exists in Codoforum version 4.8.8. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to execute client-side...

Nextcloud Server, Talk and Deck Cross-Site Scripting Vulnerabilities

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A cross-site scripting vulnerability exists in Nextcloud Server, Talk and Deck. The vulnerability stems from a lack of proper validation of client-side data b...

Maxum Rumpus Cross-Site Scripting Vulnerability

Maxum Rumpus is an FTP and Web file transfer server. A cross-site scripting vulnerability exists in Maxum Rumpus that can be exploited by an attacker to execute client-side code...