CVE-2017-11198

CVE-2017-11198 is an XSS vulnerability in FineCMS, affecting the file /application/lib/ajax/get_image.php. The issue allows remote attackers to inject arbitrary web script or HTML by manipulating the folder, id, or name parameters in FineCMS releases up to 2017-07-12. Impact is described as cross...

WakaTime: [wakatime.com] HTML Injection github-btn.html

Description === Vulnerable parameter: user Vulnerable script: https://wakatime.com/static/html/github-btn.html Vulnerable code: js var params = function var vars = , hash; var hashes = window.location.href.slicewindow.location.href.indexOf"?" + 1.split"&"; forvar i = 0; i...

RaidenHTTPD 2.0.44 User-Agent Cross Site Scripting

Exploit Title: RaidenHTTPD 2.0.44 - User-Agent - HTML Injection & Cross-site scripting Exploit Author: sultan albalawi :@bofheaded :https://hackinguyz.blogspot.com/ exploit User-Agent HTTP header : For remote testing use http-live -There is no need to use the script alertdocument.cookiewxo3i...

From PhantomJS picture rendering of XSS vulnerabilities to the SSRF/local file read vulnerability-vulnerability warning-the black bar safety net

One, Foreword Recently I was invited to study a vulnerability reward project, this project can be based on user input to generate a picture, in order for users to download. After a period time of exploring, I found a way to exploit the path, you can use the picture inside theXSSthe vulnerability ...

FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-15549)

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework development for multiple terminals, including Pc-side web pages and mobile web pages, support for customized content models and member models, and can be customized fields, can be...

CVE-2017-10975

Lutim

CVE-2017-10970

Cross-site scripting XSS vulnerability in link.php in Cacti 1.1.12 allows remote anonymous users to inject arbitrary web script or HTML via the id parameter, related to the diehtmlinputerror function in lib/htmlvalidate.php...

CVE-2017-10970

CVE-2017-10970 is a documented XSS vulnerability in Cacti 1.1.12 where remote anonymous users could inject script via the id parameter in link.php, related to lib/html_validate.php's die_html_input_error. Connected advisories confirm the issue affects Cacti 1.1.12 and indicate remediation by upgr...

hacari-nortedesantander.gov.co XSS vulnerability

Open Bug Bounty ID: OBB-260552 Description| Value ---|--- Affected Website:| hacari-nortedesantander.gov.co Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross site scripting

Multiple Cross-site scripting XSS vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to viewman.cgi, the referers parameter to changereferers.cgi, or the name parameter to saveuser.cgi. NOTE: these issues were not fixed in...

Cross site scripting

Cross-site scripting XSS vulnerability in Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified conten...

CVE-2016-6127

Cross-site scripting XSS vulnerability in Request Tracker RT 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the AlwaysDownloadAttachments config setting is not in use, allows remote attackers to inject arbitrary web script or HTML via a file upload with an unspecified conten...

ObjectPlanet Opinio Cross-Site Scripting Vulnerability

ObjectPlanet Opinio is a user survey software from ObjectPlanet USA. A cross-site scripting vulnerability exists in versions of ObjectPlanet Opinio prior to 7.6.4. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject arbitrary web script or HTML via the 1 file name or 2 collection name of videos...

CVE-2015-9105

Multiple cross-site scripting XSS vulnerabilities in Synology Video Station 1.2 before 1.2-0455, 1.5 before 1.5-0772, and 1.6 before 1.6-0847 allow remote authenticated attackers to inject arbitrary web script or HTML via the 1 file name or 2 collection name of videos...

Mail.ru: [afisha.mail.ru] HTML-инъекция через XSS на портале виджета

Insufficient input validation in combination with vulnerabilities in partner's site led to XSS in the context of afisha.mail.ru domains. afisha.mail.ru is no currently covered by Bug Bounty program. Insufficient movie id validation in a widget allowed using double dots to load arbitrary content...

ntopng cross-site scripting vulnerability (CNVD-2017-16033)

NTOPNG is the next generation version of NTOP, computer software for monitoring traffic on a computer network. A cross-site scripting vulnerability exists in ntopng. The vulnerability stems from improper validation of GET and POST parameters and can be exploited by an attacker to inject arbitrary...

CVE-2017-9836

Cross-site scripting XSS vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtualname parameter to /admin.php i.e., creating a virtual album...

Trihedral VTScada Cross-Site Scripting Vulnerability

Trihedral VTScada formerly known as VTS is a SCADA system from Trihedral Engineering, Canada, based on a Windows platform with a Web interface option. A cross-site scripting vulnerability exists in Trihedral VTScada versions prior to 11.2.26. A remote attacker could exploit this vulnerability to...

IBM Rational DOORS Next Generation and Rational Requirements Composer Code Injection Vulnerabilities

IBM Rational DOORS Next Generation DNG and Rational Requirements Composer RRC are both requirements management solutions from IBM USA. The solutions are primarily used to define, manage, and report on requirements throughout the project lifecycle. An HTML injection vulnerability exists in IBM...