CVE-2018-10391

An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI...

CVE-2018-10391

CVE-2018-10391 affects WUZHI CMS 4.1.0. The issue is a cross-site scripting (XSS) vulnerability via the email parameter in the URL index.php?m=member&v=register. This allows injection of arbitrary HTML/JS in the vulnerable context. Connected sources confirm the affected component and the vulnerab...

CVE-2018-10391

An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI...

PT-2018-9865 · Wuzhi · Wuzhi Cms

Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: An issue was discovered that allows for XSS via the email parameter to the "index.php?m=member&v=register" URI. Recommendations: For WUZHI CMS version 4.1.0, avoid using the email parameter in the...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2018-08949)

WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in WUZHI CMS version 4.1.0. A remote attacker can inject arbitrary Web script or HTML by sending the 'email' parameter ...

Cross site scripting

XSS exists in Domain Trader 2.5.3 via the recoverlogin.php emailaddress parameter...

CVE-2018-10097

XSS exists in Domain Trader 2.5.3 via the recoverlogin.php emailaddress parameter...

ClipBucket SQL Injection Vulnerability (CNVD-2018-04993)

ClipBucket is an open source video sharing software developed by Arslan team. The software allows you to share videos to video sites and supports the lights off effect when watching a movie. A SQL injection vulnerability exists in versions prior to ClipBucket 4.0.0 Release 4902. A remote attacker...

Sql injection

Multiple SQL injection vulnerabilities in Muviko 1.1 allow remote attackers to execute arbitrary SQL commands via the 1 email parameter to login.php; the 2 seasonid parameter to themes/flixer/ajax/loadseason.php; the 3 movieid parameter to themes/flixer/ajax/getrating.php; the 4 rating or 5 movie...

Sql injection

Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the 1 email parameter or 2 userid parameter to register.php...

ibccoaching.com.br XSS vulnerability

Open Bug Bounty ID: OBB-372699 Description| Value ---|--- Affected Website:| ibccoaching.com.br Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Chea...

blattstiel.ch XSS vulnerability

Vulnerable URL: http://www.blattstiel.ch/frmkontakt.cfm?Email=info%27%22%3E%3Cimg%20src=x%20onerror=alert%22OPENBUGBOUNTY%22;%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

Instacart: Bruteforcing password reset tokens, could lead to account takeover

Hey Instacart security team, Description When resetting a new password on https://shoppers.instacart.com/password you will receive an email with a reset link. when clicking on this link. you go to this page: https://shoppers.instacart.com/password/edit?resetpasswordtoken=YourToken when entering a...

Shopify: stored xss in invited team member via email parameter

Hey there, while testing your program I found a stored XSS vulnerability which can placed by owners or other staff members who have ability to manage members and it will triggered by visiting invited team member page e.g. https://partners.shopify.com/642416/invitations/15406. Reproduction Steps 1...

OXATIS 2017 Cross Site Scripting

Dear Sir or Madam, A vulnerability has been discovered in OXATIS, which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the 'EMail' parameter to '/PBSubscribe.asp' is not properly sanitised before being returned to the user. This can be exploited to...

Sql injection

SQL injection vulnerability in the mgr.login.php file in Ktools.net Photostore before 4.7.5 allows remote attackers to execute arbitrary SQL commands via the email parameter in a recoverlogin action...

LocalTapiola: SQL Injection on /webApp/sijoitustalousuk email-parameter + potential lack of CSRF Token (viestinta.lahitapiola.fi)

Moi! This is my first report - please bear with me... Summary: Boolean based blind SQL injection in /webApp/sijoitustalousuk endpoint and potential lack of CSRF Token Description: I detected that the email parameter of the POST request to http://viestinta.lahitapiola.fi/webApp/sijoitustalousuk is...

fivetran.com XSS vulnerability

Vulnerable URL: https://www.fivetran.com/login?email=7201062875='...

LocalTapiola: SQL Injection on /webApp/omatalousuk (viestinta.lahitapiola.fi)

I would like to report a SQL Injection vulnerability on viestinta.lahitapiola.fi Vulnerable Request: GET /webApp/omatalousuk?email=aaaaa HTTP/1.1 Host: viestinta.lahitapiola.fi User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.12; rv:49.0 Gecko/20100101 Firefox/49.0 Accept: text/html, /; q=0.0...

FineCMS Enterprise Email Parameter SQL Injection Vulnerability

FineCMS is a small and medium-sized content management system based on PHP+MySql+CI framework. An SQL injection vulnerability exists in the email parameter of FineCMS Enterprise Edition, as the program fails to adequately filter the email parameter, allowing attackers to exploit the vulnerability...