CVE-2020-35592

Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie...

CVE-2021-27190

A Stored Cross Site ScriptingXSS Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can ste...

CVE-2021-27190

A Stored Cross Site ScriptingXSS Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can ste...

Acronis: Cross Site Scripting (Reflected) on https://www.acronis.cz/

Summary You can post javascript and html code in form fields steps : 1-go to vulnerability link : https://www.acronis.cz/poptavka-acronis/ 2- enter this javascript code "alert1; in form field for xss and enter Test for html injection. Impact Impact 1- Cookie stealing 2- Pishing attacks 3- URL...

CVE-2020-26046

FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors...

CVE-2020-26046

FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors...

Cross site scripting

FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors...

CVE-2020-26046

FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors...

CVE-2020-26046

CVE-2020-26046 affects FUEL CMS 1.4.11. A stored cross-site scripting vulnerability exists in the Blocks/Navigation/Site variables, exploitable by an authenticated user and potentially impacting other visitors. Reported impact includes cookie stealing and other malicious actions. The available do...

4images 1.7.11 Cross Site Scripting

Exploit Title: 4images v1.7.11 - 'Profile Image' Stored Cross-Site Scripting Date: 30-12-2020 Exploit Author: Ritesh Gohil Vendor Homepage: https://www.4homepages.de/ Software Link: https://www.4homepages.de/download-4images Version: 1.7.11 Tested on: Windows 10/Kali Linux Vulnerable Parameters:...

CVE-2020-29230

EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting XSS in the Admin Panel - Manage User tab using the Full Name of the user. This vulnerability can result in the attacker injecting the XSS payload in the User Registration section and each tim...

CVE-2020-29230

EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting XSS in the Admin Panel - Manage User tab using the Full Name of the user. This vulnerability can result in the attacker injecting the XSS payload in the User Registration section and each tim...

CVE-2020-35241

FlatPress 1.0.3 is affected by cross-site scripting XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie...

Cross site scripting

FluxBB 1.5.11 is affected by cross-site scripting XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Blog Content" and each time any user will visit the blog, the XSS triggers and the attacker can able to steal the cookie according to the...

CVE-2020-29469

WonderCMS 3.1.3 is affected by cross-site scripting XSS in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie according to the...

CVE-2020-35241

FlatPress 1.0.3 is affected by a cross-site scripting (XSS) vulnerability in the Blog Content component (CVE-2020-35241). An attacker can inject arbitrary script via the admin panel, and when a user visits the affected blog page the payload executes, potentially allowing cookie theft. Exploit det...

CVE-2020-29247

WonderCMS 3.1.3 is affected by cross-site scripting XSS in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload...

Ueeshop comment section has XSS vulnerability

Ueeshop provides e-commerce website building cross-border independent station building platform. Ueeshop comment area there is an XSS vulnerability, attackers can use the vulnerability to implant malicious js code, such as stealing cookies hanging horse and other operations...

CVE-2020-35274

DotCMS Add Template with admin panel 20.11 is affected by stored XSS that could let an attacker gain remote privileges and potentially steal cookies. The vulnerability is described as stored XSS in the admin template functionality, enabling a compromise of a website or web application through XSS...

CVE-2020-29239

Online Birth Certificate System Project V 1.0 is affected by cross-site scripting XSS. This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the View Detail of Application section from the admin panel, the attacker can able t...