147 matches found
Horde Webmail 5.2.22 - Multiple Vulnerabilities
Title: Horde Webmail - XSS + CSRF to SQLi, RCE, Stealing Emails var url = "http://webmail.victimserver.com/trean/"; var params =...
DumpTheGit - Searches Through Public Repositories To Find Sensitive Information Uploaded To The Github Repositories
DumpTheGit searches through public repositories to find sensitive information uploaded to the Github repositories. The tool will flag the matches for potentially sensitive files like credentials, secret keys, tokens etc which have been accidentally uploaded by the developers. DumpTheGit just...
Moderate severity vulnerability that affects total.js
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...
CVE-2019-10260
Total.js CMS 12.0.0 is affected by a Cross-Site Scripting (XSS) vulnerability in the admin UI: item.message handling in themes/admin/views/index.html and column.format handling in themes/admin/public/ui.js. The connected sources consistently identify the vulnerable components but do not provide a...
CVE-2019-10260
Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...
Sql injection
SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string...
CVE-2018-19893
SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string...
Cisco Network NVF Infrastructure Software (NFVIS) Detection (HTTP)
HTTP based detection of Cisco Network NVF Infrastructure Software NFVIS. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2018-16236
CVE-2018-16236 affects cPanel through version 74, allowing XSS via a crafted filename in the logs subdirectory of a user account. The root cause is that the filename is mishandled during rendering of frontend/THEME/raw/index.html, enabling script injection. Exploit details (in-the-wild, vectors) ...
medidata.ch XSS vulnerability
Open Bug Bounty ID: OBB-624093 Description| Value ---|--- Affected Website:| medidata.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-9307
dsmall v20180320 allows XSS via the pdrsn parameter to public/index.php/home/predeposit/index.html...
CVE-2018-9307
dsmall v20180320 allows XSS via the pdrsn parameter to public/index.php/home/predeposit/index.html...
Cross site request forgery (csrf)
dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdrsn= request...
onecommon.ofo.com XSS vulnerability
Open Bug Bounty ID: OBB-585881 Description| Value ---|--- Affected Website:| onecommon.ofo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Code injection
dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/addressid/2.html...
CVE-2018-8070
QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...
ClipBucket <= 4.0.0 Multiple Vulnerabilities
ClipBucket is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oxygenz:clipbucket"; if...
ommf.gov.hu XSS vulnerability
Vulnerable URL: http://www.ommf.gov.hu/index.html?portalon=1menu=204="&Submit4;= Details: Description| Value ---|--- Patched:| Yes, at 02.12.2017 Latest check for patch:| 02.12.2017 06:40 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated V...
WordPress: Arbitrary file deletion in wp-core - guides towards RCE and information disclosure
Vulnerable place 1: wp-admin/post.php $newmeta'thumb' is placed into DB not sanitized directly from user input. case 'editattachment': checkadminreferer'update-post' . $postid; // Don't let these be changed unset$POST'guid'; $POST'posttype' = 'attachment'; // Update the thumbnail filename $newmet...
