XWiki >= 2.5-milestone-2 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as:...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the deviceid parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet contains a...

Add DOM EventListener - Detection

Identifies the use of JavaScript addEventListener calls in the DOM. !/usr/bin/env python3 -- coding: utf-8 -- """Identifies the use of JavaScript addEventListener calls in the DOM.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

RockMongo 1.1.8 - Cross-Site Scripting Detection

RockMongo 1.1.8 contains a cross-site scripting vulnerability which allows attackers to inject arbitrary JavaScript into the response returned by the application. !/usr/bin/env python3 -- coding: utf-8 -- """RockMongo 1.""" from kittysploit import from lib.protocols.http.httpclient import...

Weglot API Key - Exposed Detection

Detected Weglot API key was found exposed in a publicly accessible JavaScript file. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Weglot API key was found exposed in a publicly accessible JavaScript file.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Jenkins build-metrics 1.3 - Cross-Site Scripting Detection

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins build-metrics 1.""" from kittysploit import from...

MindPalette NateMail 3.0.15 - Cross-Site Scripting Detection

MindPalette NateMail 3.0.15 is susceptible to reflected cross-site scripting which could allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note...

Jolokia 1.3.7 - Cross-Site Scripting Detection

Jolokia 1.3.7 is vulnerable to cross-site scripting in the HTTP servlet and allows an attacker to execute malicious JavaScript in the victim's browser. !/usr/bin/env python3 -- coding: utf-8 -- """Jolokia 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

XWiki >= 13.10.8 - Cross-Site Scripting Detection

Reflected XSS vulnerability in XWiki authenticate endpoints allows execution of arbitrary JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected XSS vulnerability in XWiki authenticate endpoints allows execution of arbitrary JavaScript.""" from kittysploit import from...

idcCMS V1.60 - Cross-Site Scripting Detection

idcCMS V1.60 is vulnerable to reflected cross-site scripting XSS via the idName parameter in read.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """idcCMS V1.""" from kittysploit import from...

Label Studio < 1.16.0 - Cross-Site Scripting Detection

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

Bitrix Component - Cross-Site Scripting Detection

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to 1 enumerate attachments on the server and 2 execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim ha...

XWiki >= 6.0-rc-1 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as:...

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting Detection

Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting Detection

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the flag parameter in menu.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """Yonyou UFIDA ERP-NC V5.""" from kittysploit...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting Detection

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """Yonyou UFIDA...

MAMP Server - Cross-Site Scripting Detection

A Cross-Site Scripting XSS vulnerability exists in the default installation of MAMP server. The file /Applications/MAMP/htdocs/index.php is susceptible to malicious input, allowing attackers to inject JavaScript code that executes in the context of the victim's browser. This vulnerability can be...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet is vulnerable to cross-site scripting via the devicegraphpage.php script via the is2sim parameter. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet is...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the graph parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet contains a cross-site...