SEO Backlinks <= 4.0.1 - CSRF to Stored XSS

The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the locconfig function found in the /seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1. CSRF PoC alert1" / alert1" / function csrfSubmit let submit...

Business Logic Errors in pimcore/pimcore

✍️ Description Pimcore is vulnerable to Business Logic error through negative products amount. 🕵️‍♂️ Proof of Concept HTML content: HTML 1. Save the above content into an HTML file. 2. Open the HTML file on the browser and click on Submit button. 3. Check out the total price. PoC video. 💥 Impact It...

Glass <= 1.3.2 - CSRF to Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack. Add the following...

GetSimple CMS Custom JS 0.1 CSRF / XSS / Code Execution

Exploit Title: GetSimple CMS Custom JS v0.1 - CSRF to XSS to RCE Exploit Author: Bobby Cooke boku & Abhishek Joshi Date: April 30th, 2021 Vendor Homepage: http://get-simple.info Software Link: http://get-simple.info/download/ & http://get-simple.info/extend/plugin/custom-js/1267/ Vendor: 4Enzo...

Business Directory Plugin < 5.11.2 - Arbitrary Listing Export

The plugin suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator export files, which could then be downloaded by the attacker to get access to PII, such as email, home addresses etc The state is base64 encoded and will need to be adapted to the...

U.S. Dept Of Defense: Administration Authentication Bypass on https://█████

Hi there I found a way to connect to an administration space on your website https://██████████ how to reproduce ? 1 - go to this link : https://███/██████████ 2 - create a html file with : html 3 - launch the file, click on the button and return to the page https://███████/█████ 4 - refresh the...

CVE-2019-14840

A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials...

Backdoor.Win32.Agent.aak Code Execution / Cross Site Request Forgery

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/64f2fd4dbd9039e5bc054f475eaa582aB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Agent.aak Vulnerability: Cross Site Request Forgery CSRF - Code Execution Descriptio...

Map Block for Google Maps < 1.32 - Unauthorised Google API Key change

The gmwmapblocksavekey AJAX action, available to both authenticated and unauthenticated users did not have any check in place to prevent unauthorised change of the Google API key...

Simple Social Buttons < 3.2.0 - Reflected Cross-Site Scripting

Simple Social Buttons version 3.1.1 has a reflected Cross-Site Scripting vulnerability in the POST parameter "sharecounts". Both unauthenticated and authenticated attacks are possible Edit WPScanTeam The original report stated the issue as being fixed in 3.2.0, however a CSRF nonce has been added...

MediaWiki cross-site scripting vulnerability (CNVD-2021-38685)

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A cross-site scripting vulnerability exists in MediaWiki version 1.34.x prior...

UBUNTU-CVE-2020-25812

An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML...

Path traversal

A remote code execution RCE vulnerability was discovered in the htmlformentry aka HTML Form Entry module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed...

CVE-2020-24621

A remote code execution RCE vulnerability was discovered in the htmlformentry aka HTML Form Entry module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed...

CSRF tokens leaked in URL by canned query form

Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitti...

GHSA-Q6J3-C4WC-63VW CSRF tokens leaked in URL by canned query form

Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitti...

CVE-2019-19987

CVE-2019-19987 affects Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29.0. The vulnerability is a Cross-Site Request Forgery (CSRF) in the web application’s handling of HTML forms, allowing an attacker to abuse functions such as change password, add user, and add privilege. Root c...

Pricing Table by Supsystic < 1.8.1 - Cross-Site Request Forgery to XSS and Setting Changes

CSRF can be exploited against any of the functionalities in the Pricing Table by Supsystic WordPress plugin in vulnerable versions. One example:...

Online Book Store 1.0 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Book Store 1.0 - Arbitrary File Upload Exploit Author: Or4nG.M4n aka S4udiExploit Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/ Software Link:...

Stripo Inc: CSRF - Modify Project Settings

Target Url/Endpoint https://my.stripo.email/cabinet/stripeapi/v1/projects/ProjectId Note Attacker just need to know victim project Id. Summary: This CSRF Vulnerability leads to change user's project settings including General Information, Contacts, Social Networks and Other Options. Steps To...