PoC Exploit Compromises Microsoft Live Accounts via Subdomain Hijacking

A proof-of-concept PoC attack details how an attacker can gain access a victim’s Microsoft Live webmail session, without having the person’s credentials. It relies upon the hijack of a Microsoft-owned Live.com website subdomain. The PoC, developed by CyberInt, demonstrates what it characterizes a...

Stored Cross-site Scripting Vulnerability in S-CMS E-commerce System

S-CMS e-commerce system is an e-commerce software. A stored cross-site scripting vulnerability exists in the S-CMS e-commerce system. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...

Stored Cross-Site Scripting Vulnerability in "I want to submit a paper" in the background of Daimi CMS

DAMI CMS is a PC building station and cell phone building station integrated all-in-one system. A stored cross-site scripting vulnerability exists in the "I want to submit" section of the backend of Daimi CMS. An attacker can insert malicious js code into the page to obtain user cookies and other...

Stored Cross-site Scripting Vulnerability in the Frontend of Online Training System of Beijing Xinqi Technology Co.

Beijing Xinqi Technology Co., Ltd. is a technical service enterprise specializing in the research and development of training management software. A stored cross-site scripting vulnerability exists in the frontend of the online training system of Beijing Xinqi Technology Co. An attacker can inser...

Adobe Experience Manager HTML Injection Vulnerability

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. An HTM...

Adobe Experience Manager HTML Injection Vulnerability (CNVD-2019-06891)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. An HTM...

Storage-type cross-site scripting vulnerability at the front-end posting message of PawnBuilder CMS

SmallBuild CMS is a website management backend based on the OneThink open source framework. A stored cross-site scripting vulnerability exists in the front-end posting message of PawnBuilder CMS. Attackers by building a CSRF add administrator user can insert malicious js code in the page to obtai...

DSMALL open source mall B2B2C front-end storage type cross-site scripting attack vulnerabilities

DSMALL open source mall B2B2C is a very professional shopping mall system source code , through this set of source code can create a shopping mall website , suitable for doing Taobao or do e-commerce platform users. DSMALL open source mall B2B2C front storage type cross-site scripting attack...

Responsive Filemanager Cross-Site Scripting Vulnerability

Responsive FileManager is an open source file manager written in PHP that supports uploading and managing videos, images and other files. A cross-site scripting vulnerability exists in Responsive Filemanager version 9.8.1, which can be exploited by a remote attacker to execute script in a victim'...

Responsive Filemanager 9.8.1 Cross Site Scripting

I. VULNERABILITY ------------------------- Responsive Filemanager 9.8.1 Reflected Cross Site Scripting XSS II. CVE REFERENCE ------------------------- CVE-2018-18062 III. VENDOR ------------------------- https://www.responsivefilemanager.com IV. REFERENCES -------------------------...

CVE-2018-15903

The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting XSS. An authenticated attacker will be able to place malicious JavaScript in the discussion forum, which is present in the login landing page. A low privilege user can use this to steal the session cookies...

Stored Cross-Site Scripting Vulnerability at User Information Modification in Five Fingers CMS

Five Fingers CMS is an open source content management system that supports LNAMP architecture. A stored cross-site scripting vulnerability exists in Five Fingers CMS at the modification of user information. Attackers can insert malicious js code in the page to obtain user cookies and other...

XSS Vulnerability in Skylark Online Customer Service System

Lark Online Customer Service System is a software that can provide manual service to users online. Lark Online Customer Service System has an XSS vulnerability that can be exploited by attackers to obtain user cookies...

XSS Vulnerability in Laoban CMS V2.0

Laoban CMS content management system referred to as: Laoban CMS is developed by Laoban based on PHP + MYSQL environment of the open source station-building system. Laoban CMS V2.0 exists XSS vulnerability, the vulnerability stems from the system fails to html materialization of the message data,...

Stored Cross-Site Scripting Vulnerability in JEECMS Version 9.3

JEECMS is Jiangxi Jinlei Technology Development Co., Ltd. developed a support for WeChat small program, WeChat public number / service number, column model, content model cross-customization, as well as with the payment and financial settlement of the content of the e-commerce as one of the conte...

OTCMS cross-site scripting vulnerability (CNVD-2018-19093)

OTCMS is an article-based web content management system CMS. A cross-site scripting vulnerability exists in the admin/users.php file in OTCMS version 3.61, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'dataTypeCN', 'dataMode' and...

XSS vulnerability in 74cms

74cms is a PHP + MYSQL based on the core development of a set of free + open source professional recruitment system. 74cms has an XSS vulnerability that allows an attacker to insert malicious js code into a page to obtain user cookies and other information, resulting in user hijacking...

SAP NetWeaver WebDynpro Java Cross-Site Scripting Vulnerability

SAP Enterprise Financial Services is a set of enterprise financial services solutions from SAP. A cross-site scripting vulnerability exists in SAP NetWeaver, which arises from a failure to properly sanitize user-supplied input and can be exploited by a remote attacker to execute arbitrary script...

Jspxcms Comments Feature Has XSS Vulnerability

Jspxcms is an open source, Java-based content management system CMS. An XSS vulnerability exists in the comments feature of Jspxcms version 9.0.0, which stems from the failure to encode user-submitted parameters as html entities and to escape special characters, which can be exploited by an...

Adrenalin HRMS Software Cross-Site Scripting Vulnerability

Adrenalin HRMS Software is a human resource management system from Adrenalin eSystems India. A cross-site scripting vulnerability exists in the 'strAction' parameter of the flexiportal/GeneralInfo.aspx file in Adrenalin HRMS Software version 5.4.0. A remote attacker can exploit this vulnerability...