John CMS 5.1 Cross Site Scripting

Exploit Title : JohnCMS 5.1 Persistent XSS Vulnerability Author : DevilScreaM Date : 08/09/2013 Category : Web Applications Vendor : http://johncms.com/ Product Link : http://johncms.com/download/?cat=481 Version : 1.0 - 5.1 Dork intext:Powered by JohnCMS Vulnerability : Persistent XSS...

Persistent XSS in Username field

The XSS vulnerability is only present in some parts of the UI where the username is incorrectly marked as "safe" for HTML output. Known vulnerability points: When viewing a user's activity stream on their profile page When viewing the site-wide activity stream in the Administrative UI This...

WordPress Usernoise Plugin 3.7.8 - Persistent XSS

Usernoise plugin is prone to a persistent XSS vulnerability, because the user input is not being properly handled when a feedback is submitted. The affected area is the Wordpress admin dashboard. The vulnerability accepts arbitrary codes, including JavaScript. And all JavaScript code is executed...

Dell PacketTrap MSP RMM 6.6.x - Multiple Cross-Site Scripting Vulnerabilities

Dell PacketTrap MSP RMM 6.6.x - Multiple Cross-Site Scripting Vulnerabilities Title: ====== Dell PacketTrap MSP RMM 6.6.x - Multiple Persistent Web Vulnerabilities Date: ===== 2013-07-17 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=791 VL-ID: ===== 791 Common...

WordPress WooCommerce 2.0.12 Cross Site Scripting

WooCommerce 2.0.12 Persistent XSS Details ============================================================================== Product: WooCommerce 2.0.12 Security-Risk: High Remote-Exploit: yes Vendor-URL: http://www.woothemes.com/woocommerce/ Advisory-Status: NotPublished Credits...

Dell Kace 1000 SMA 5.4.70402 - Persistent Cross-Site Scripting

Dell Kace 1000 SMA 5.4.70402 - Persistent Cross-Site Scripting Title: ====== Dell Kace 1000 SMA v5.4.70402 - Persistent Vulnerabilities Date: ===== 2013-07-16 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=833 VL-ID: ===== 833 Common Vulnerability Scoring System:...

OpenEMR 4.1.1 patch-12 Cross Site Scripting / SQL Injection

Trustwave SpiderLabs Security Advisory TWSL2013-018: Multiple Vulnerabilities in OpenEMR Published: 07/12/13 Version: 1.0 Vendor: OEMR www.open-emr.org Product: OpenEMR Version affected: 4.1.1 patch-12 and prior Product description: OpenEMR is an ONC-ATB Ambulatory EHR 2011-2012 certified...

Cross-Site Scripting vulnerabilities in WordPress

Hello 3APA3A! These are Cross-Site Scripting vulnerabilities in WordPress. Which I've disclosed last week. At WordPress 3.5.2 release, WP developers mentioned about three holes as "security hardenings" to decrease their importance and to make it looks like there were less fixed holes. One of thes...

xss

This plugin finds Cross Site Scripting XSS vulnerabilities. One configurable parameters exists: persistentxss To find XSS bugs the plugin will send a set of javascript strings to every parameter, and search for that input in the response. The "persistentxss" parameter makes the plugin store all...

CKEditor < 4.1 Drupal 6.x & 7.x - Persistent XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: Persistent XSS in wysiwyg CKEditor + Disclosure and Fix: This was disclosed to Drupal on 20/01/13, and was fixed with the release of ckeditor 4.1...

Fedora 18 : php-geshi-1.0.8.11-3.fc18 (2013-5472)

Update to 1.0.8.11 : - Fix for CVE-2012-3521 : Remote directory traversal and information disclosure local file inclusion in the contrib module. - Fix for CVE-2012-3522 : Non-persistent XSS in langwiz contrib script. Note that Tenable Network Security has extracted the preceding description block...

OTRS 3.x - FAQ Module Persistent Cross-Site Scripting

Exploit Title: OTRS Faq Module - Persistent XSS Date: 2-Apr-2013 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.otrs.com Version: OTRS ITSM 3.2.x,OTRS ITSM 3.1.x,OTRS ITSM 3.0.x Tested on: Perl CVE : CVE-2013-2637 OVERVIEW The OTRS ITSM FAQ Module 3.2.x and below is vulnerable to a...

OTRS 3.x - FAQ Module Persistent Cross-Site Scripting

OTRS 3.x - FAQ Module Persistent Cross-Site Scripting Exploit Title: OTRS Faq Module - Persistent XSS Date: 2-Apr-2013 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.otrs.com Version: OTRS ITSM 3.2.x,OTRS ITSM 3.1.x,OTRS ITSM 3.0.x Tested on: Perl CVE : CVE-2013-2637 OVERVIEW The OTRS...

OTRS FAQ Module - Persistent XSS

The OTRS ITSM FAQ Module 3.2.x and below is vulnerable to a persistant XSS that permit some client side attack like cookies grabbing. OTRS http://www.otrs.com is a flexible Help Desk and IT-Service Management Software distribuited as opensource project AGPL License and also as-a-service. WIth a...

OTRS FAQ Cross Site Scripting

Exploit Title: OTRS Faq Module - Persistent XSS Date: 2-Apr-2013 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.otrs.com Version: OTRS ITSM 3.2.x,OTRS ITSM 3.1.x,OTRS ITSM 3.0.x Tested on: Perl CVE : CVE-2013-2637 OVERVIEW The OTRS ITSM FAQ Module 3.2.x and below is vulnerable to a...

WordPress FuneralPress Plugin 1.1.6 - Persistent XSS

FuneralPress plugin is prone to a persistent cross-site scripting vulnerabilities. These vulnerabilities allow attackers to host malicious Javascript on another site, enter a path to a local image in , if Photo was selected. Also, attackers can submit the form with the following entered into...

Wordpress FuneralPress Plugin 1.1.6 - Persistent XSS

Exploit for php platform in category web applications A low-privilege or guest user can inject code via the , and elements which are part of the wpfhuploadform form in http://site/obituaries/?id=ID&f=guestbook&m=add Scripts injected via the "photo-message" and "youtube-message" elements will be...

Network Weathermap 0.97a Cross Site Scripting

Network Weathermap 0.97a - Persistent XSS Earlier versions are also possibly vulnerable. INFORMATION Product: Network Weathermap 0.97a Remote-exploit: yes Vendor-URL: http://www.network-weathermap.com/ Discovered by: Daniel Ricardo dos Santos CVE Request - 15/03/2013 CVE Assign - 18/03/2013 CVE...

IP.Gallery 4.2.x and 5.0.x Persistent XSS Vulnerability

Exploit for php platform in category web applications Exploit Title: IP.Gallery 4.2.x and 5.0.x persistent XSS vulnerability image title is vulnerable to persistent XSS vulnerability which allow any normal member to hack any administrator account or any other member account. we contacted the vend...

phpVibe 3.1 Persistent XSS Vulnerability

This exploit allow attackers to inject script code in members list 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type local, remote, DoS,...