MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting

Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting Date: 12/31/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=396 Version: 1.8.3 Tested on: Ubuntu 18.04 CVE: CVE-2019-3501 1. Description: OUGC Awards...

CVE-2018-20663

The Reporting Addon aka Reports Addon through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports Reports" name field...

CVE-2018-20663

The Reporting Addon aka Reports Addon through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports Reports" name field...

Cross site scripting

The Reporting Addon aka Reports Addon through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports Reports" name field...

CVE-2018-20663

The Reporting Addon aka Reports Addon through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports Reports" name field...

CVE-2018-20663

The CVE-2018-20663 entry describes a Persistent XSS vulnerability in the CUBA Platform Reporting Addon (aka Reports Addon) affecting versions up to 6.10.x, with the flaw exploitable via the name field under Reports > Reports. Evidence across sources (NVD entry and multiple vulnerability tracke...

Cross site scripting

No-CMS 1.1.3 is prone to Persistent XSS via the blog/managearticle/index/ "articletitle" parameter...

CVE-2018-19901

No-CMS 1.1.3 is prone to Persistent XSS via the blog/managearticle/index/ "articletitle" parameter...

Cross site scripting

No-CMS 1.1.3 is prone to Persistent XSS via the blog/managearticle "keyword" parameter...

CVE-2018-19901

No-CMS 1.1.3 is prone to Persistent XSS via the blog/managearticle/index/ "articletitle" parameter...

CVE-2018-19902

No-CMS 1.1.3 is prone to Persistent XSS via the blog/managearticle "keyword" parameter...

CVE-2018-19904

Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field...

CVE-2018-19902

Vulnerability summary (CVE-2018-19902): No-CMS 1.1.3 is susceptible to a Persistent XSS attack via the blog/manage_article page, specifically through the keyword parameter. The available records indicate the issue is a stored/reflected-like XSS path focused on this input vector, but do not provid...

CVE-2018-19902

No-CMS 1.1.3 is prone to Persistent XSS via the blog/managearticle "keyword" parameter...

CVE-2018-19901

No-CMS 1.1.3 is prone to Persistent XSS via the blog/managearticle/index/ "articletitle" parameter...

CVE-2018-19904

CVE-2018-19904 corresponds to a Persistent XSS in XSLT CMS, exploitable via the create/?action=items.edit&type=Page endpoint in the body field. The vulnerability is documented across multiple sources (NVD entry and related advisories) and is described as XSS affecting the body field, with PoC ind...

CVE-2018-19901

CVE-2018-19901 affects No-CMS 1.1.3 and is described as a persistent XSS vulnerability exploitable via the blog/manage_article/index/“article_title” parameter. The available public records identify the vulnerable component/entry point but do not provide exploit code, affected versions beyond 1.1....

CVE-2018-19903

This CVE concerns XSLT CMS, a PHP/XML/XSLT-based content management system. The vulnerability is a Persistent XSS flaw exploited through the title field in the create/?action=items.edit&type=Page endpoint, enabling injection of script/HTML. Root cause, per the description, is improper handling/es...

PT-2018-15154 · Xslt · Xslt Cms

Name of the Vulnerable Software and Affected Versions: XSLT CMS affected versions not specified Description: A persistent XSS issue exists in XSLT CMS, allowing exploitation via the "body" field in the create/?action=items.edit&type=Page endpoint. Recommendations: At the moment, there is no...

US Indicts Two Chinese Government Hackers Over Global Hacking Campaign

The US Department of Justice on Thursday charged two Chinese hackers associated with the Chinese government for hacking numerous companies and government agencies in a dozen countries. The Chinese nationals, Zhu Huaknown online as Afwar, CVNX, Alayos and Godkiller and Zhang Shilong known online a...