CVE-2019-14549

An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity, thus stealing user cookies when someone visits the publicly accessible...

Stored Cross-Site Scripting Vulnerability in Morphology Digital Lab Teaching Platform Frontend

Morphology digital experimental teaching platform is a virtual reality system with the core of computer virtual reality and digital simulation technology, supported by biosimulation engine, processing factor database, virtual environment interface and other technologies. Morphology digital...

CVE-2019-13387

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php parameter fmcurrentdir allows attackers to steal a cookie or session, or redirect to a phishing website...

CVE-2019-13387

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php parameter fmcurrentdir allows attackers to steal a cookie or session, or redirect to a phishing website...

Design/Logic Flaw

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php parameter fmcurrentdir allows attackers to steal a cookie or session, or redirect to a phishing website...

CVE-2019-13387

In CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php parameter fmcurrentdir allows attackers to steal a cookie or session, or redirect to a phishing website...

PT-2019-13306 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.846 Description: The issue allows attackers to steal a cookie or session, or redirect to a phishing website through Reflected XSS in the filemanager2.php file, specifically targeting the fm current dir parameter...

WordPress: Reflected XSS on https://make.wordpress.org via 'channel' parameter

Hi there, I just found a reflected XSS on make.wordpress.org domain. steps to reproduce : 1. visit this link : https://make.wordpress.org/chat/logs?channel=16%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain%3E&date=2019-07-21&nobots=1 2. xss pop up will occurs POC: see:wp reflected xss.png Not...

XSS Vulnerability in KPPW Wizards System

KPPW-v3.3 crowdsourcing wiki system developed by Wuhan Kiker Information Technology Co., Ltd. is a set of large-scale platform system based on the laravel framework developed for project transactions, settlement. There is an XSS vulnerability in the KPPW system, which can be exploited to obtain...

CVE-2019-3414

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

Cross site scripting

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

CVE-2019-1010235

Frog CMS 1.1 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets...

Stored Cross-site Scripting Vulnerability in Hsycms Frontend Messages

Hsycms is an enterprise-level web content management system, written by PHP+MYSQL, using template separation technology to support the creation of many types of sites. A stored cross-site scripting vulnerability exists in the Hsycms frontend message. An attacker can insert malicious js code into...

GitLab: Stored XSS in "Create Groups"

NOTE! Thanks for submitting a report! Please replace all the parenthesized sections below with the pertinent details. Remember, the more detail you provide, the easier it is for us to triage and respond quickly, so be sure to take your time filling out the report! Summary Stored attacks are those...

Concrete CMS: Unauthenticated reflected XSS in preview_as_user function

An unauthenticated, reflected cross-site-scripting attack is possible due to the unsanitised cID parameter in the previewasuser functionality. Example URL: https://LOCAL-CONCRETE-INSTALL/ccm/system/panels/page/previewasuser/preview?cID=%22%3E%3C/iframe%3E%3Cscript%3Ealert1%3C/script%3E%3C!-- The...

UBUNTU-CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting XSS. The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the attacker...

PT-2019-11436 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 6.0.4 Description: The issue affects the htdocs/product/stats/card.php component and allows for Cross Site Scripting XSS, which can lead to cookie stealing. The attack vector involves a victim clicking a specially crafted lin...

CVE-2018-20852

CVE-2018-20852 describes a flaw in Python’s http.cookiejar DefaultPolicy.domain_return_ok where domain validation is insufficient, allowing an attacker-controlled server to siphon cookies by using a host name that has another valid hostname as a suffix (e.g., pythonicexample.com to access example...

Stored Cross-site Scripting Vulnerability in the Us***.cl***.php File in the Frontend of the Feifei Movie and TV Navigation System

FeiFei Film and TV Navigation System FeiFeiCms is a free and open source PHP movie program. A stored cross-site scripting vulnerability exists in the Us.cl.php file in the frontend of FeiFeiCms. Attackers can insert malicious js code in the page to obtain user cookies and other information,...

Stored Cross-Site Scripting Vulnerability in OpenSNS_v6.0

OpenSNS is a lightweight social user center framework based on OneThink. The system adheres to a minimalist design style and focuses on communication. A stored cross-site scripting vulnerability exists in OpenSNSv6.0. An attacker can insert malicious js code into a page to obtain user cookies and...