CVE-2017-14536

CVE-2017-14536 affects the trixbox 2.8.0.4 release and is a cross-site scripting (XSS) vulnerability triggered via PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php. The available data describe the vulnerability as an XSS flaw without details on exploitation steps, affected...

CVE-2017-14535: Improper Neutralization of Special Elements used in an OS Command

trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php...

CVE-2017-14536: Improper Neutralization of Input During Web Page Generation

trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...

PT-2018-5682

Name of the Vulnerable Software and Affected Versions: trixbox version 2.8.0.4 Description: The issue concerns path traversal via the xajaxargs array parameter to "/maint/index.php?packages" or the lang parameter to "/maint/modules/home/index.php". Recommendations: For trixbox version 2.8.0.4,...

PT-2018-5680

Name of the Vulnerable Software and Affected Versions: trixbox version 2.8.0.4 Description: The issue is related to OS command injection via shell metacharacters in the lang parameter to the "/maint/modules/home/index.php" API endpoint. This allows for potential exploitation. Recommendations: For...

PT-2018-5681

Name of the Vulnerable Software and Affected Versions: trixbox version 2.8.0.4 Description: The issue is related to a security problem where an attacker can execute malicious scripts in the browser of other users, potentially leading to unauthorized actions. This is achieved by manipulating the...

Joomla! Component Fastball 2.5 - season SQL Injection

Joomla! Component Fastball 2.5 - season SQL Injection Exploit Title: Joomla! Component Fastball 2.5 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.fastballproductions.com/ Software Link: http://www.fastballproductions.com/ Version: 2.5 Category: Webapps Tested on:...

Joomla! Component Google Map Landkarten 4.2.3 - SQL Injection

Exploit Title: Joomla! Component Google Map Landkarten = 4.2.3 - SQL Injection Dork: N/A Date: 16.02.2018 Vendor Homepage: http://www.joomla-24.de/ Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/google-map-landkarten/ Software Download:...

royalprincehoteldubai.com XSS vulnerability

Open Bug Bounty ID: OBB-555595 Description| Value ---|--- Affected Website:| royalprincehoteldubai.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2015-3618

Cross-site scripting XSS vulnerability in Nagios Business Process Intelligence BPI before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving index.php...

CVE-2015-3618

Nagios Business Process Intelligence (BPI) is affected by a Cross-site scripting (XSS) vulnerability in which an attacker can inject arbitrary web script or HTML via index.php. The issue affects BPI releases prior to 2.3.4. Root cause is an XSS flaw in the web interface, leading to potential impa...

CVE-2015-3618: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Nagios Business Process Intelligence BPI before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving index.php...

PT-2018-4370

Name of the Vulnerable Software and Affected Versions Nagios Business Process Intelligence BPI versions prior to 2.3.4 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This is achieved through vectors involving the "index.php" endpoint...

Design/Logic Flaw

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

CVE-2018-6550

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

CVE-2018-6550

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

CVE-2018-6550: Improper Neutralization of Input During Web Page Generation

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

PT-2018-17629

Name of the Vulnerable Software and Affected Versions Monstra CMS versions prior to 3.0.5 Description The issue concerns a problem with the title function in the pages.plugin.php file within the plugins/box/pages directory. This problem allows for XSS attacks when a page title is sent to...

CVE-2014-1631

Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php...

PT-2018-4173

Name of the Vulnerable Software and Affected Versions Eventum versions prior to 2.3.5 Description The issue allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter in the htdocs/setup/index.php file. Recommendations For versions prior to 2.3.5, update to versio...