ADB Epicentro Code Injection Vulnerability

ADB Epicentro is a set of firmware used in ADB gateway and router devices from ADB Switzerland. A code injection vulnerability exists in the 'form Language' parameter of the /ui/login page in ADB Epicentro version E7.3.2+, which can be exploited to execute JavaScript code by tricking a user into...

QIWI: XSS https://agent.postamat.tech/ в профиле + дисклоз секретной информации

Здравствуйте. Я раскрутил ваш сайт https://agent.postamat.tech/ на интересную XSS + достаточно серьезный баг, который дисклозит некоторую пользовательскую информацию. Хочу заметить что на данном сайте хранятся некоторые личные данные пользователей, следовательно из этой XSS можно извлечь достаточ...

HackerOne: Lack of input sanitization in Marketo form leads to execution of HTML in lead emails

Hi, There is SSRF vulnerability due to img tag injection in "Contact HackerOne Sales" form. Since vulnerability triggers after 18-20 minutes so I am not sure which site it affects. It might affect hackerone or marketo. So I thought it would be better to report it first on hackerone. POC 1. Naviga...

plone reflective cross-site scripting vulnerability (CNVD-2016-07278)

Plone is a free, open source Content Management System CMS. Plone suffers from a reflected cross-site scripting vulnerability that allows an attacker to inject potential cross-site scripting attacks into forms...

elgg (xss/csrf/change password) Multiple Vulnerabilities

No description provided by source. + CMS Elgg 1.00 XSS;CSRF;Cambia PasswordMultiple Remote Vulnerabilities + Discovered By ThE Lorddemon [email protected] + Vendor:http://elgg.org/ + Greetings: Project MEMI-Bolivia, OpTix, RTM security Group http://zonartm.og Change Password Remotely:...

Mambo Component n-form - 'form_id' Blind SQL Injection

!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if!$ARGV1 system"Title Kosova Hackers Group by boom3rang"; print " \n"; print " \n"; print " Mambo Component n-formformid Blind SQL Injection Exploit \n"; print " -----------------------------------------------------------\n"; print " Author:...

Dvbbs8 Action Network Forum latest 0day research-vulnerability warning-the black bar safety net

I here it has been assumed that a DVBBS8 SQL: We first register a user, just find a post. Just broke。。。。 We have to re-send a post. Discovery table review, where to capture | POST /dvbbs8/Appraise. asp? action=save HTTP/1.1 Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,...

[KAPDA::#8] Domain Manager Pro Vulnerability

KAPDA::8 Domain Manager Pro Vulnerability Domain Manager Pro - Fake form injection KAPDA New advisory Vulnerable Products : Domain Manager Pro Vendor: SiteTurn ,http://www.siteturn.com/ Vulnerability: Fake form injection XSS Date : -------------------- 2005/08/08 1384/05/17 Hijri Shamsi About...