558 matches found
phpIPAM 1.4 - SQL Injection
!/usr/bin/env python3 Exploit Title: phpIPAM Custom Field Filter SQL Injection Exploit Announcement Date: September 16, 2019 5:18 AM Exploit Creation Date: September 27, 2019 Exploit Author: Kevin Kirsche Vendor Homepage: https://phpipam.net Software Link:...
phpIPAM 1.4 - SQL Injection
phpIPAM 1.4 - SQL Injection !/usr/bin/env python3 Exploit Title: phpIPAM Custom Field Filter SQL Injection Exploit Announcement Date: September 16, 2019 5:18 AM Exploit Creation Date: September 27, 2019 Exploit Author: Kevin Kirsche Vendor Homepage: https://phpipam.net Software Link:...
CVE-2019-8450
Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a custom...
CVE-2017-18611
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWPCreateCustomFieldPage.php custom-field-css parameter...
Joomla JS Jobs 1.2.6 Arbitrary File Delete
Exploit Title: Joomla! component comjsjobs 1.2.6 - Arbitrary File Deletion Dork: inurl:"index.php?option=comjsjobs" Date: 2019-08-16 Exploit Author: qw3rTyTy Vendor Homepage: https://www.joomsky.com/ Software Link: https://www.joomsky.com/5/download/1 Version: 1.2.6 Tested on: Debian/nginx/joomla...
HackerOne: Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled
The Custom Field feature is currently only available for customers on the Enterprise product edition. A trial period can be given by enabling the custom-fields-trial feature for programs who are not on that product edition yet. However, when enabling this feature, the incorrect ordering of an ACL...
Multiple Registration - Critical - Access bypass - SA-CONTRIB-2019-048
This module enables you to use special routes for user registration with special roles and custom field sets defined for the role. The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role. This...
WordPress Custom Field Suite Plugin < 2.5.15 XSS Vulnerability
The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...
CVE-2019-11871
The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...
CVE-2019-11871
The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...
Design/Logic Flaw
The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...
CVE-2019-11871
The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...
CVE-2019-11871
The CVE-2019-11871 entry concerns the WordPress plugin Custom Field Suite, affected in versions before 2.5.15. The vulnerability is an authenticated Cross-Site Scripting (XSS) flaw exploitable by editors or admins. The available connected documents confirm the affected component and scope but do ...
Custom Field Suite <= 2.5.14 - Authenticated Cross-Site Scripting (XSS)
The Custom Field Suite WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...
HackerOne: IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs
Specifying a report ID of another team when requesting a CSV export leaks the ID of the Custom Field Attribute in the CSV header. Request POST /reports/export HTTP/1.1 Host: localhost:8080 ... ----------868143055 Content-Disposition: form-data; name="reportids" 17 ----------868143055...
Advanced Custom Fields <= 5.7.7 - Authenticated Cross-Site Scripting (XSS)
According to the vendor: "This release contains a fix to a recently reported XSS vunerability sic. This report showed it was possible for a logged in author to save unfiltered HTML within a custom field value. This is something that should not be possible without the unfilteredhtml capability."...
DomainMOD cross-site scripting vulnerability (CNVD-2018-26480)
DomainMod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets. A cross-site scripting vulnerability exists in the admin/domain-fields/ page in DomainMod 4.11.01 and earlier versions. A remote attacker can exploit this vulnerabilit...
CVE-2018-19750
DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields...
CVE-2018-19750
DomainMOD up to version 4.11.01 contains a stored cross-site scripting (XSS) vulnerability in the admin/domain-fields notes field used when adding a Custom Domain Field. The issue is triggered via input in the notes field of the Add Custom Field action for Custom Domain Fields. The available docu...