CVE-2015-1180

Cross-site scripting XSS vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet...

CVE-2015-1311

The Extended Application Services XS in SAP HANA allows remote attackers to inject arbitrary ABAP code via unspecified vectors, aka SAP Note 2098906. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

PhotoSync 1.1.3 Android - Command Inject Vulnerability

Document Title: =============== PhotoSync 1.1.3 Android - Command Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1410 Release Date: ============= 2015-01-21 Vulnerability Laboratory ID VL-ID: ==================================== 141...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the management web UI in the RabbitMQ management plugin before 3.4.3 allow remote authenticated users to inject arbitrary web script or HTML via 1 message details when a message is unqueued, such as headers or arguments; 2 policy names, which a...

CVE-2014-9477

Multiple cross-site scripting XSS vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 url parameter...

CVE-2015-1053

Cross-site scripting XSS vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/filemanager/filemanager/editfile...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative backend in Croogo before 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the path parameter to admin/filemanager/filemanager/editfile...

CVE-2015-1052

Cross-site scripting XSS vulnerability in the poll archive in PHPKIT 1.6.6 Build 160014 allows remote attackers to inject arbitrary web script or HTML via the result parameter to uploadfiles/pk/include.php...

Cross site scripting

Cross-site scripting XSS vulnerability in /signup in WEBCrafted allows remote attackers to inject arbitrary web script or HTML via the username...

CVE-2014-100028

Cross-site scripting XSS vulnerability in /signup in WEBCrafted allows remote attackers to inject arbitrary web script or HTML via the username...

VeryPhoto v3.0 iOS - Script Code Inject Web Vulnerability

Document Title: =============== VeryPhoto v3.0 iOS - Script Code Inject Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1401 Release Date: ============= 2015-01-13 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2014-9271

Cross-site scripting XSS vulnerability in filedownload.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in Social Microblogging PRO 1.5 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI, related to the "Web Site" input in the Profile section...

Windows Inject DLL, Hidden Bind Ipknock TCP Stager

Inject a custom DLL into the exploited process. Listen for a connection. First, the port will need to be knocked from the IP defined in KHOST. This IP will work as an authentication method you can spoof it with tools like hping. After that you could get your shellcode from any IP. The socket will...

Windows Inject DLL, Hidden Bind TCP Stager

Inject a custom DLL into the exploited process. Listen for a connection from a hidden port and spawn a command shell to the allowed host. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule...

PuttyRider - Hijack Putty sessions in order to sniff conversation and inject Linux commands

PuttyRider injects a DLL into a running putty.exe process in order to sniff all communication and inject Linux commands on the remote server. This can be useful in an internal penetration test when you already have access to a sysadmin’s machine who has a Putty session open to a Linux server. You...

CVE-2014-9120

Cross-site scripting XSS vulnerability in Subrion CMS before 3.2.3 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to subrion/search/...

CVE-2014-9241

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the 1 type parameter to report.php, 2 signature parameter in a doeditsig action to usercp.php, or 3 title parameter in the...

CVE-2014-9179

Cross-site scripting XSS vulnerability in the SupportEzzy Ticket System plugin 1.2.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the "URL optional" field in a new ticket...