CVE-2020-29230

EGavilanMedia User Registration and Login System With Admin Panel 1.0 is affected by cross-site scripting XSS in the Admin Panel - Manage User tab using the Full Name of the user. This vulnerability can result in the attacker injecting the XSS payload in the User Registration section and each tim...

CVE-2020-35241

FlatPress 1.0.3 is affected by cross-site scripting XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie...

Cross site scripting

FluxBB 1.5.11 is affected by cross-site scripting XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Blog Content" and each time any user will visit the blog, the XSS triggers and the attacker can able to steal the cookie according to the...

CVE-2020-29469

WonderCMS 3.1.3 is affected by cross-site scripting XSS in the Menu component. This vulnerability can allow an attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can steal the cookie according to the...

CVE-2020-35241

FlatPress 1.0.3 is affected by a cross-site scripting (XSS) vulnerability in the Blog Content component (CVE-2020-35241). An attacker can inject arbitrary script via the admin panel, and when a user visits the affected blog page the payload executes, potentially allowing cookie theft. Exploit det...

CVE-2020-29247

WonderCMS 3.1.3 is affected by cross-site scripting XSS in the Admin Panel. An attacker can inject the XSS payload in Page keywords and each time any user will visit the website, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload...

Ueeshop comment section has XSS vulnerability

Ueeshop provides e-commerce website building cross-border independent station building platform. Ueeshop comment area there is an XSS vulnerability, attackers can use the vulnerability to implant malicious js code, such as stealing cookies hanging horse and other operations...

CVE-2020-35274

DotCMS Add Template with admin panel 20.11 is affected by stored XSS that could let an attacker gain remote privileges and potentially steal cookies. The vulnerability is described as stored XSS in the admin template functionality, enabling a compromise of a website or web application through XSS...

CVE-2020-29239

Online Birth Certificate System Project V 1.0 is affected by cross-site scripting XSS. This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the View Detail of Application section from the admin panel, the attacker can able t...

Cross site scripting

There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload...

Automattic: Reflected XSS on a Atavist theme at external_import.php

Summary: Hi team, I found this php file https://magazine.atavist.com/static/externalimport.php , and there is a parameter called scripts on this php file. Basically, the endpoint prints value of scripts parameter to . So we can import any script file like that :...

Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting

Exploit Title: Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting Date: 2020-09-01 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://savsoftquiz.com/ Software Link: https://savsoftquiz.com/web/demo.php Version: 5.0 Tested on: Windows 10/Kali Linux Contact:...

Acronis: Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/

Summary Hello, There is possible to inject arbitrary HTML constructions on the page /admin/su/. The problem is in the insufficient escaping of special characters like for the Error parameter. If this parameter contains a specially crafted vector, the application will return the page that will...

CVE-2020-24609

TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie v...

CVE-2020-24609

Savsoft Quiz 5.5 and earlier is affected by CVE-2020-24609 (Stored XSS). The vulnerability resides in the User Registration flow, where an attacker can inject a payload that triggers when the admin visits the Manage Users page, enabling cookie theft. Multiple connected sources corroborate a store...

Automattic: Reflected XSS at /category/ on a Atavis theme

Summary: Hi team, This report is similar to 947790 You fixed the XSS on search, but I found another XSS at /category/xsspayload For PoC you can check these URLs : https://magazine.atavist.com/category/%22%3E%3Csvg%20onload%3Dalert%60XSS%60%3E...

Android Cookie-Stealing Malware Found Hijacking Facebook Accounts

A new simple but dangerous strain of Android malware has been found in the wild that steals users' authentication cookies from the web browsing and other apps, including Chrome and Facebook, installed on the compromised devices. Dubbed "Cookiethief " by Kaspersky researchers, the Trojan works by...

Topcoder: Reflected-XSS on https://www.topcoder.com/tc via pt parameter

Summary: I Found an XSSReflected at the URL mentioned and the injected parameter is: pt Steps To Reproduce: 1-go to this URL https://www.topcoder.com/tc?module=ReviewBoard&pt=1 $$you will recognize that is parameter pt is reflecting its value into the page 2- try injecting this parameter with HTM...

Huawei EulerOS: Security Advisory for python (EulerOS-SA-2019-2259)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Engel & Völkers Technology GmbH BBP: Stored XSS in Watch Lists

Summary: Hi team, I added a house to my Watch List by clicking "Star" button in a property. And I saw this request. █████ Firstly, I changed value of the title parameter to alertdocument.cookie and I sent this request. But the name of property was same in my Watch list. So I tried to change IDs i...