CVE-2020-24861: Improper Neutralization of Input During Web Page Generation

GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page...

CVE-2020-14223: Improper Neutralization of Input During Web Page Generation

HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting XSS. The vulnerability could be employed in a reflected or non-persistent XSS attack...

PT-2020-15845

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.16 Description The issue concerns a persistent Cross Site Scripting XSS flaw. It occurs through the permalink parameter on the Settings page. The XSS is executed when creating and opening a new page. Recommendations F...

GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)

Exploit Title: GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting Authenticated Google Dork: - Date: 2020-09-29 Exploit Author: Roel van Beurden Vendor Homepage: http://get-simple.info Software Link: http://get-simple.info/download Version: 3.3.16 Tested on: Linux Ubuntu 18.04 CVE: N/A 1...

Non-persistent XSS in the Storefront in Shopware

Impact Non-persistent XSS in the Storefront Patches We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin:...

GHSA-QVHR-55HG-3QWV Non-persistent XSS in the Storefront in Shopware

Impact Non-persistent XSS in the Storefront Patches We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin:...

CVE-2020-24924: Improper Neutralization of Input During Web Page Generation

A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...

RAD SecFlow-1v SF_0290_2.3.01.26 Cross Site Scripting

Exploit Title: RAD SecFlow-1v SF02902.3.01.26 - Persistent Cross-Site Scripting Date: 2020-08-31 Exploit Author: Jonatan Schor and Uriel Yochpaz Vendor Homepage: https://www.rad.com/products/secflow-1v-IIoT-Gateway Version: SecFlow-1v os-image SF02902.3.01.26 Tested on: RAD SecFlow-1v CVE : N/A A...

CVE-2020-24198: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'...

PT-2020-15870

Name of the Vulnerable Software and Affected Versions Best Support System version v3.0.4 Description An Authenticated Persistent XSS issue was found. Recommendations For version v3.0.4, at the moment, there is no information about a newer version that contains a fix for this issue...

CVE-2020-24963: Improper Neutralization of Input During Web Page Generation

An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4...

Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting

Exploit Title: Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting Date: 2020-09-01 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://savsoftquiz.com/ Software Link: https://savsoftquiz.com/web/demo.php Version: 5.0 Tested on: Windows 10/Kali Linux Contact:...

Cross-site Scripting (XSS) - Stored in monicahq/monica

Description HTML codes can be entered and successfully run in the journal session of Monica, which allows an attacker to trigger XSS query's like causing a persistant stored XSS in the journal session. files at monica/2. Fix Suggestion Sanitize the input / escape the xss charecters or else escape...

PT-2020-15616

Name of the Vulnerable Software and Affected Versions Online Hotel Booking System Pro PHP version 1.3 Description The issue is related to Persistent Cross-site Scripting in the customer registration form, allowing malicious code to be executed. This affects the all-tags section of the form...

CVE-2020-23983: Improper Neutralization of Input During Web Page Generation

Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags...

CVE-2020-23974: Improper Neutralization of Input During Web Page Generation

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Messagetitle-tag, Add new client all-tags...

vBulletin 5.6.2 Persistent Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: vBulletin 5.6.2 Stored XSS Date:15.08.2020 Author: Vincent666 ibn Winnie Software Link: https://www.vbulletin.com/en/features/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog : https://pentest-vincent.blogspot.com/ PoC:...

Home Villas <= 2.2 - Multiple Cross-Site Scripting Issues

An Unauthenticated Reflected & Authenticated Persistent XSS vulnerabilities were discovered in the Home Villas theme through 2.2 for WordPress. Edit WPScanTeam: July 27th, 2020 - Confirmed & Escalated to Envato July 28th, 2020 - Envato Investigating August 17th, 2020 - No updates, disclosing...

Dolibarr Persistent Cross Site Scripting (CVE-2020-13094)

A persistent cross site scripting vulnerability exists in Dolibarr. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

WordPress NextGen Gallery Sell Photo 1.0.5 Cross Site Scripting

Exploit Title: Wordpress Plugin NextGen Gallery Sell Photo 1.0.5 - Persistent Cross-Site Scripting Date: 2020-08-14 Vendor Homepage: https://noorsplugin.com/ Vendor Changelog: https://wordpress.org/plugins/nextgen-gallery-sell-photo/developers Exploit Author: Melbin K Mathew @melbinkm Author...