320 matches found
Shopify: One Click XSS in [www.shopify.com]
Steps To Reproduce: 1. You need a web server, put F1722320 to www 2. visit it: http://:/poc.html?x=$alert1 3. click it 4. you will see the alert Supporting Material: F1722333 Impact Cookie Stealing - A malicious user can steal cookies and use them to gain access to the application. Arbitrary...
CVE-2022-1411
Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to...
Microweber vulnerable to cross-site scripting (XSS)
Microweber is a drag and drop website builder and a powerful next generation CMS. Microweber versions 1.2.15 and prior are vulnerable to cross-site scripting. This could lead to injection of arbitrary JaveScript code, defacement of a page, or stealing cookies. A patch is available on the master...
GHSA-7PFC-CX3M-V22X SCart is vulnerable to cross-site scripting (XSS)
SCart e-commerce is a free open source for businesses, built on the Laravel framework. The package s-cart/s-cart before 6.9 and the package s-cart/core before 6.9 are vulnerable to cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL. An attacker c...
SCart is vulnerable to cross-site scripting (XSS)
SCart e-commerce is a free open source for businesses, built on the Laravel framework. The package s-cart/s-cart before 6.9 and the package s-cart/core before 6.9 are vulnerable to cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL. An attacker c...
CVE-2022-21149
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie...
Cross site scripting
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie...
CVE-2022-21149 Cross-site Scripting (XSS)
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie...
CVE-2022-21149
CVE-2022-21149 affects the s-cart project: s-cart/s-cart and s-cart/core versions before 6.9 are vulnerable to Cross-site Scripting (XSS) that can allow an attacker to steal cookies and impersonate a user. The underlying issue is an XSS flaw in the affected components that enables execution of ar...
CVE-2022-21149 Cross-site Scripting (XSS)
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting XSS which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie...
Credential-stealing malware disguises itself as Telegram, targets social media users
A credential-stealing Windows-based malware, Spyware.FFDroider, is after social media credentials and cookies, according to researchers at ThreatLabz. The version analyzed by the researchers was packed with Aspack. The spyware is offered on download sites pretending to be installers for freeware...
Cross-site Scripting (XSS) - Reflected
Description The endpoint https://demo.microweber.org/demo/admin/post/id/edit is vulnerable to cross site scripting. The "Edit source" field is affected. Proof of Concept 1. Login into https://demo.microweber.org 2. Navigate to https://demo.microweber.org/demo/admin/post/25/edit 3. click EditSourc...
Cross-site Scripting (XSS) - Reflected
Description Hi, The endpoint https://demo.microweber.org/demo/admin/page is vulnerable to Cross Site Scripting. Proof of Concept 1. just navigate to the poc url:...
Cross-site Scripting (XSS) - Stored in microweber/microweber
Description There is a reflected XSS in creating and searching tag function . where any user can execute any malicious code results in the cookie stealing or Account takeover vulnerability Steps to Produce: Go to this particular URL URL Click on live edit , Now In the tag section and select the...
Cross-site Scripting (XSS) - Stored in s-cart/core
Description Multiple Stored XSS exists in S-Cart Version 6.8.4 and below leads to cookie stealing of any victim that visits the affected URL. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie. Proof of Conce...
Cross-Site Scripting (XSS)
pimcore/pimcore is vulnerable to stored cross-site scripting. The vulnerability exists in getReportConfigAction function of CustomReportController.php which allows an attacker to steal cookies and get access...
Cross-site Scripting (XSS) - Stored in vanessa219/vditor
Description the editor has XSS vulnerability Proof of Concept payload: Open the editorhttps://ld246.com/guide/markdown, enter the payload, and trigger the XSS vulnerability demo pic : https://drive.google.com/file/d/1fl07CUXSS0DyvjtuftslMnyr2uGZ8F7/view?usp=sharing Impact This vulnerability has t...
Free School Management Software 1.0 - (multiple) Stored Cross-Site Scripting Vulnerability
Exploit Title: Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting XSS Exploit Author: fuzzyap1 Category: Web application Vendor Homepage: https://www.sourcecodester.com/php/15073/free-school-management-software.html Software Link:...
Free School Management Software 1.0 Cross Site Scripting
Exploit Title: Free School Management Software 1.0 - 'multiple' Stored Cross-Site Scripting XSS Exploit Author: fuzzyap1 Date: 7-12-2021 Category: Web application Vendor Homepage: https://www.sourcecodester.com/php/15073/free-school-management-software.html Software Link:...
Online Enrollment Management System in PHP and PayPal 1.0 - (U_NAME) Stored XSS Vulnerability
Exploit Title: Online Enrollment Management System in PHP and PayPal 1.0 - 'UNAME' Stored Cross-Site Scripting Exploit Author: Tushar Jadhav Vendor Homepage: https://www.sourcecodester.com/ Software Link:...