FancyBox Plugin for WordPress 'mfbfw' Parameter Persistent XSS

The version of the FancyBox plugin for WordPress installed on the remote host is affected by a persistent cross-site scripting vulnerability due to a failure properly sanitize user-supplied input to the 'mfbfw' POST parameter when the 'action' parameter is set to 'update'. A remote, unauthenticat...

WordPress Calls to Action <= 2.2.7 - Stored XSS

The AJAX action ‘inboundformsave’ allows unauthenticated users to update the content of any specific form on the site. In order to exploit this, a form ID must be enumerated using another unauthenticated AJAX action, ‘inboundgetformdata’. Once a form ID has been enumerated, the content of the for...

Lazarus Guestbook 1.22 - Multiple Vulnerabilities

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= INDEPENDENT SECURITY RESEARCHER PENETRATION TESTING SECURITY -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Exploit Title: Lazarus Guestbook 1.22 Multiple Persistent Cross-Site Scripting - Sql Injection Vulnerability Date: 23/12/2014 Url Vendor:...

Persistent XSS Vulnerability in CMS Papoo Light v6.0.0 Rev. 4701

Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6 Advisory ID: SROEADV-2014-01 Author: Steffen Rцsemann Affected Software: CMS Papoo Version 6.0.0 Rev. 4701 Vendor URL: http://www.papoo.de/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability Description:...

Papoo CMS 6.0.0 Rev. 4701 - Stored XSS Vulnerability

Exploit for php platform in category web applications Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6 Author: Steffen Rösemann Affected Software: CMS Papoo Version 6.0.0 Rev. 4701 Vendor URL: http://www.papoo.de/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability...

CMS Papoo 6.0.0 Revision 4701 Cross Site Scripting

Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6 Advisory ID: SROEADV-2014-01 Author: Steffen Rösemann Affected Software: CMS Papoo Version 6.0.0 Rev. 4701 Vendor URL: http://www.papoo.de/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability Description:...

Humhub 0.10.0-rc.1 Cross Site Scripting / SQL Injection

Humhub 1 SQL injection vulnerability + Discovered by: Jos Wetzels, Emiel Florijn + Affects: Humhub condition is injected with the otherwise unsanitized $lastEntryId, which can be any SQL injection. Proof of Concept: Performing the following request index.php?r=notification/list/index&from=999 AND...

Altitude uAgent - Altitude uCI 7.5 XSS

Altitude uAgent - Altitude uCI 7.5 Persistent XSS Details ======================================================================================== Product: Altitude uAgent - Altitude uCI 7.5 Security-Risk: High Vendor-URL: http://www.altitude.com CVE-ID:CVE-2014-9212 Credits...

CSRF and XSS vulnerabilities in D-Link DAP-1360

Hello 3APA3A! There are Cross-Site Request Forgery and Cross-Site Scripting vulnerabilities in D-Link DAP-1360 Wi-Fi Access Point and Router. ------------------------- Affected products: ------------------------- Vulnerable is the next model: D-Link DAP-1360, Firmware 1.0.0. This model with other...

FlatNuke 3.1.x Cross Site Scripting

------------------------------------------------------------------------- + FlatNuke alertdocument.cookie&body=This is my comment ------------------------------------------------------------------------------------------------...

FlatNuke 3.1.4 (FlatPoll) Persistent XSS Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------- + FlatNuke alertdocument.cookie&body=This is my comment ------------------------------------------------------------------------------------------------ 0day.today...

Folder Plus 2.5.1 iOS - Persistent XSS Vulnerability

No description provided by source. Document Title: =============== Folder Plus v2.5.1 iOS - Persistent Item Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1348 Release Date: ============= 2014-10-24 Vulnerability Laboratory ID VL-ID:...

MODx CMS 2.2.14 - Cross-Site Request Forgery Bypass / Reflected Cross-Site Scripting / Persistent Cross-Site Scripting

Advisory ID: 92152 Product: MODX Revolution Vendor: MODX Vulnerable Versions: 2.0.0–2.2.14 Tested Version: 2.2.14 Advisory Publication: 16 July, 2014 without technical details Vendor Notification: 16 July, 2014 Vendor Patch: 15 July, 2014 Public Disclosure: 2 November , 2014 Vulnerability Type:...

Clockingit.com Cross Site Scripting

Affected software: clockingit.com Type of vulnerability: persistent xss URL: clockingit.com Discovered by: Provensec Website: http://www.provensec.com Description: peristet xss issue Proof of concept victim can be exploited by just sending the link to the victim To execute this vector goto regist...

vBulletin 5.x / 4.x Persistent Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-2021 - vBulletin 5.x/4.x - persistent XSS in AdminCP/ApiLog via xmlrpc API post-auth ============================================================================ ==================== Overview - -------- date : 10/12/2014 cvss : 4.6...

GetSimple CMS 3.3.1 - Cross-Site Scripting

PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1 CVE-2014-1603 by Pedro Ribeiro [email protected] from Agile Information Security Disclosure: 12/05/2014 / Last updated: 12/10/2014 Timeline: 04/11/2013 - Found bugs, produced proof of concept. 05/11/2013 - Communicated to the developer,...

WordPress All In One WP Firewall Plugin 3.8.3 - Persistent XSS

WordPress All In One WP Firewall plugin is prone to a persistent XSS vulnerability. It results session hijacking, persistent external redirect to malicious sources, persistent phishing attacks and application-side manipulation of affected module context. Solution Update the plugin...

Epicor Enterprise 7.4 - Multiple Vulnerabilities

Epicor suffers from cross site scripting and password disclosure vulnerabilities. "Epicor Enterprise vulnerabilities" - Affected vendor: Epicor Software Corporation - Affected system: Epicor Enterprise - Version 7.4 - Vendor disclosure date: May 13th, 2014 - Public disclosure date: September 30th...

insight.ly Cross Site Scripting

Author:Provensec Vendor: insight.ly Vulnerability Type:persistent xss Discription: Integrated online customer relationship management CRM and project management makes sure you are on top of critical business processes. Exploit: 1 Goto add contacts 2 Fill the work address field with xss payload...

phpMyFAQ 2.8.X - Multiple Vulnerabilities

No description provided by source. Title: phpMyFAQ 2.8.X - Multiple Vulnerabilities Vendor: phpmyfaq.de Date: 04.09.19 Version: = 2.8.12 Latest ATM Tested on: Apache 2.2 / PHP 5.4 / Linux Contact: smash at devilteam.pl 1 Persistent XSS Administrator is able to view information about specific user...