1883 matches found
Nextcloud: XSS through image upload of contacts using svg file
This is a bypass of report 808287 Upload the attached file for the image of a contact, right click "Open image in new tab" and you will see the xss. Impact The person viewing the image of a contact can be victim of XSS...
CVE-2020-13980
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you...
CVE-2020-13980
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you...
Design/Logic Flaw
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you...
CVE-2020-13980
OpenCart 3.0.3.3 is vulnerable to a cross-site scripting (XSS) issue triggered by a crafted filename in the users’ image upload section. The root cause is a lack of proper entity encoding in filenames, and this issue is noted as a follow-up to an incomplete fix for CVE-2020-10596. The vulnerabili...
CVE-2020-13980
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you...
PT-2020-13815 · Opencart · Opencart
Name of the Vulnerable Software and Affected Versions: OpenCart version 3.0.3.3 Description: The issue allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. This problem exists due to an incomplete...
Gila CMS Remote Code Execution (CVE-2020-5514)
A remote code execution vulnerability exists in Gila CMS. The vulnerability is due to improper validation of user supplied files during image upload...
OpenCart 3.0.3.2 - Stored Cross Site Scripting (Authenticated) Vulnerability
Exploit for php platform in category web applications Exploit Title: OpenCart 3.0.3.2 - Stored Cross Site Scripting Authenticated Exploit Author: Kailash Bohara Vendor Homepage: https://www.opencart.com Software Link: https://www.opencart.com/index.php?route=cms/download Version: OpenCart...
OpenCart 3.0.3.2 - Stored Cross Site Scripting (Authenticated)
Exploit Title: OpenCart 3.0.3.2 - Stored Cross Site Scripting Authenticated Date: 2020-06-01 Exploit Author: Kailash Bohara Vendor Homepage: https://www.opencart.com Software Link: https://www.opencart.com/index.php?route=cms/download Version: OpenCart UsersUsers and click on Action button on top...
Gym Management System 1.0 - Unauthenticated Remote Code Execution Exploit
Exploit for php platform in category web applications Exploit Title: Gym Management System 1.0 - Unauthenticated Remote Code Execution Exploit Author: Bobby Cooke Vendor Homepage: https://projectworlds.in/ Software Link:...
Gym Management System 1.0 Remote Code Execution
Exploit Title: Gym Management System v1.0 - Unauthenticated Remote Code Execution Exploit Author: Bobby Cooke Date: May 21th, 2020 Vendor Homepage: https://projectworlds.in/ Software Link: https://projectworlds.in/free-projects/php-projects/gym-management-system-project-in-php/ Version: 1.0 Teste...
CVE-2020-8035
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...
DEBIAN-CVE-2020-8035
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...
Cross site scripting
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...
UBUNTU-CVE-2020-8035
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...
CVE-2020-8035
The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting XSS vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL...
School ERP Pro 1.0 - Remote Code Execution Vulnerability
Exploit for php platform in category web applications Exploit Title: School ERP Pro 1.0 - Remote Code Execution Author: Besim ALTINOK Vendor Homepage: http://arox.in Software Link: https://sourceforge.net/projects/school-erp-ultimate/ Version: latest version Tested on: Xampp Credit: İsmail BOZKUR...
CVE-2020-1895
A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128...
Heap overflow
A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affects versions prior to 128.0.0.26.128...