311 matches found
Cross site scripting
There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload...
Automattic: Reflected XSS on a Atavist theme at external_import.php
Summary: Hi team, I found this php file https://magazine.atavist.com/static/externalimport.php , and there is a parameter called scripts on this php file. Basically, the endpoint prints value of scripts parameter to . So we can import any script file like that :...
Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting
Exploit Title: Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting Date: 2020-09-01 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://savsoftquiz.com/ Software Link: https://savsoftquiz.com/web/demo.php Version: 5.0 Tested on: Windows 10/Kali Linux Contact:...
Acronis: Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/
Summary Hello, There is possible to inject arbitrary HTML constructions on the page /admin/su/. The problem is in the insufficient escaping of special characters like for the Error parameter. If this parameter contains a specially crafted vector, the application will return the page that will...
CVE-2020-24609
TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel, the XSS triggers and the attacker can steal the cookie v...
CVE-2020-24609
Savsoft Quiz 5.5 and earlier is affected by CVE-2020-24609 (Stored XSS). The vulnerability resides in the User Registration flow, where an attacker can inject a payload that triggers when the admin visits the Manage Users page, enabling cookie theft. Multiple connected sources corroborate a store...
Automattic: Reflected XSS at /category/ on a Atavis theme
Summary: Hi team, This report is similar to 947790 You fixed the XSS on search, but I found another XSS at /category/xsspayload For PoC you can check these URLs : https://magazine.atavist.com/category/%22%3E%3Csvg%20onload%3Dalert%60XSS%60%3E...
Android Cookie-Stealing Malware Found Hijacking Facebook Accounts
A new simple but dangerous strain of Android malware has been found in the wild that steals users' authentication cookies from the web browsing and other apps, including Chrome and Facebook, installed on the compromised devices. Dubbed "Cookiethief " by Kaspersky researchers, the Trojan works by...
Topcoder: Reflected-XSS on https://www.topcoder.com/tc via pt parameter
Summary: I Found an XSSReflected at the URL mentioned and the injected parameter is: pt Steps To Reproduce: 1-go to this URL https://www.topcoder.com/tc?module=ReviewBoard&pt=1 $$you will recognize that is parameter pt is reflecting its value into the page 2- try injecting this parameter with HTM...
Huawei EulerOS: Security Advisory for python (EulerOS-SA-2019-2259)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Engel & Völkers Technology GmbH BBP: Stored XSS in Watch Lists
Summary: Hi team, I added a house to my Watch List by clicking "Star" button in a property. And I saw this request. █████ Firstly, I changed value of the title parameter to alertdocument.cookie and I sent this request. But the name of property was same in my Watch list. So I tried to change IDs i...
WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting
WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Exploit Title: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting Google Dork: inurl:/wp-content/themes/zoner/ Date: 2019-09-24 Exploit Author: m0ze Vendor Homepage: https://fruitfulcode.com/ Software...
CVE-2019-15230
LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account...
Design/Logic Flaw
LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account...
CVE-2019-15230
CVE-2019-15230 affects LibreNMS v1.54, with a cross-site scripting (XSS) vulnerability in the admin console modules Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template. The flaw allows an authenticated attacker to inject client-side scripts, poten...
CVE-2019-15227
FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions...
Design/Logic Flaw
FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions...
CVE-2019-15227
FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions...
CVE-2019-15228
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors...
CVE-2019-15228
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors...