RAD SecFlow-1v SF_0290_2.3.01.26 Cross Site Scripting

Exploit Title: RAD SecFlow-1v SF02902.3.01.26 - Persistent Cross-Site Scripting Date: 2020-08-31 Exploit Author: Jonatan Schor and Uriel Yochpaz Vendor Homepage: https://www.rad.com/products/secflow-1v-IIoT-Gateway Version: SecFlow-1v os-image SF02902.3.01.26 Tested on: RAD SecFlow-1v CVE : N/A A...

Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting

Exploit Title: Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting Date: 2020-09-01 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://savsoftquiz.com/ Software Link: https://savsoftquiz.com/web/demo.php Version: 5.0 Tested on: Windows 10/Kali Linux Contact:...

Cross-site Scripting (XSS) - Stored in monicahq/monica

Description HTML codes can be entered and successfully run in the journal session of Monica, which allows an attacker to trigger XSS query's like causing a persistant stored XSS in the journal session. files at monica/2. Fix Suggestion Sanitize the input / escape the xss charecters or else escape...

vBulletin 5.6.2 Persistent Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: vBulletin 5.6.2 Stored XSS Date:15.08.2020 Author: Vincent666 ibn Winnie Software Link: https://www.vbulletin.com/en/features/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog : https://pentest-vincent.blogspot.com/ PoC:...

Home Villas <= 2.2 - Multiple Cross-Site Scripting Issues

An Unauthenticated Reflected & Authenticated Persistent XSS vulnerabilities were discovered in the Home Villas theme through 2.2 for WordPress. Edit WPScanTeam: July 27th, 2020 - Confirmed & Escalated to Envato July 28th, 2020 - Envato Investigating August 17th, 2020 - No updates, disclosing...

WordPress NextGen Gallery Sell Photo 1.0.5 Cross Site Scripting

Exploit Title: Wordpress Plugin NextGen Gallery Sell Photo 1.0.5 - Persistent Cross-Site Scripting Date: 2020-08-14 Vendor Homepage: https://noorsplugin.com/ Vendor Changelog: https://wordpress.org/plugins/nextgen-gallery-sell-photo/developers Exploit Author: Melbin K Mathew @melbinkm Author...

Dolibarr Persistent Cross Site Scripting (CVE-2020-13094)

A persistent cross site scripting vulnerability exists in Dolibarr. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

CVE-2020-15597

SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field...

Cross site scripting

SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field...

CVE-2020-15597

SOPlanning 1.46.01 allows persistent XSS via the Project Name, Statutes Comment, Places Comment, or Resources Comment field...

CVE-2020-15597

CVE-2020-15597 affects SOPlanning prior to or at version 1.46.01, where persistent XSS is possible through input fields Project Name, Statutes Comment, Places Comment, or Resources Comment due to insufficient input validation. The vulnerability is described across multiple sources (NVD, Red Hat a...

CVE-2020-15056

TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name...

CVE-2020-15056

CVE-2020-15056 affects TP-Link TL-PS310U USB Network Server devices up to version 2.079.000.t0210. Affected function is the server name setting under administrative privileges, allowing an attacker on the same network to perform persistent cross-site scripting via a crafted server name. The vulne...

Car Rental Management System 1.0 Cross Site Scripting

Exploit Title: Car Rental Management System v1.0 - Unauthenticated Persistent XSS Session Harvester Exploit Author: Bobby Cooke Date: August 6, 2020 Vendor Homepage: https://projectworlds.in Software Link: https://github.com/projectworlds32/Car-Rental-Syatem-PHP-MYSQL/archive/master.zip Version:...

CVE-2020-15944

An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability, an attacker has to be authenticat...

Input validation

An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability, an attacker has to be authenticat...

CVE-2020-15944

An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability, an attacker has to be authenticat...

CVE-2020-13971

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...

Design/Logic Flaw

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...

CVE-2020-13971

Shopware CVE-2020-13971 affects Shopware before 6.2.3. Authenticated users can use the Mediabrowser fileupload to upload SVG images containing JavaScript, causing Persistent XSS. An uploaded image can be accessed without authentication, enabling the attack to be carried out by non-privileged user...