Unrestricted file upload

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer or no mitigations implemented for file content checks; also, the output is not handled...

CVE-2019-14748

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer or no mitigations implemented for file content checks; also, the output is not handled...

CVE-2019-14748

CVE-2019-14748 affects osTicket versions prior to 1.10.7 and 1.12.x prior to 1.12.1. The ticket creation form allows file uploads without sufficient content validation and improper output handling, causing persistent XSS (e.g., uploading a .html file) that can lead to cookie theft or malicious ac...

CVE-2019-14748: Improper Neutralization of Input During Web Page Generation

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer or no mitigations implemented for file content checks; also, the output is not handled...

1CRM On-Premise Software 8.5.7 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications 1CRM On-Premise Software 8.5.7 Stored XSS //////////////////////////////////////////////////////////////////////////////////// Exploit Title: 1CRM On-Premise Software 8.5.7 - Cross-Site Scripting Date: 19/07/2019 Exploit Author: Kusol...

CVE-2019-5401

A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss injection by setting the attack vector in one of the switch persistent configuration fields management URL, location, contact. But admin privileges are required to configure the...

Ultimate Loan Manager 2.0 - Cross-Site Scripting

Exploit Title:Web Studio Ultimate Loan Manager V2.0 - Persistent Cross Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: http://www.webstudio.co.zw/ Software Link: https://codecanyon.net/item/ultimate-loan-manager/19891884 Version: V2.0 Category: Webapps Software...

PT-2019-17641

Name of the Vulnerable Software and Affected Versions HP2910al-48G version W.15.14.0016 Description A potential security issue has been identified, which exploits an XSS injection by setting the attack vector in one of the switch's persistent configuration fields, such as management URL, location...

CVE-2019-5401: Improper Neutralization of Input During Web Page Generation

A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss injection by setting the attack vector in one of the switch persistent configuration fields management URL, location, contact. But admin privileges are required to configure the...

CVE-2019-3958

Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks via a crafted sales transaction...

CVE-2019-3958

Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks via a crafted sales transaction...

CVE-2019-3958

Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks via a crafted sales transaction...

PT-2019-16807

Name of the Vulnerable Software and Affected Versions WallacePOS version 1.4.3 Description The issue is related to insufficient output sanitization, which allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks. This can be achieved via a crafted sales...

CVE-2019-3958: Improper Neutralization of Input During Web Page Generation

Insufficient output sanitization in WallacePOS 1.4.3 allows a remote, authenticated attacker to conduct persistent cross-site scripting XSS attacks via a crafted sales transaction...

CVE-2018-20864

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain SEC-454...

CVE-2018-20864: Improper Input Validation

cPanel before 76.0.8 allows a persistent Virtual FTP accounts after removal of its associated domain SEC-454...

CVE-2019-14415: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. A persistent cross-site scripting XSS vulnerability allows a malicious VRP user to inject malicious script into another user's browser, related to resiliency plans functionality. A victim must open a resiliency plan that a...

GigToDo 1.3 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection Author: m0ze Vendor Homepage: https://www.gigtodoscript.com Software Link: https://codecanyon.net/item/gigtodo-freelance-marketplace-script/23855397 Version: =...

GigToDo 1.3 Cross Site Scripting

Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection Google Dork: - Date: 2019/07/28 Author: m0ze Vendor Homepage: https://www.gigtodoscript.com Software Link: https://codecanyon.net/item/gigtodo-freelance-marketplace-script/23855397 Version: = 1.3 Tested on:...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: GitHub Integration SSRF Trigger Token Impersonation Build Status Disclosure SSRF Mitigation Bypass Information Disclosure New Issue ID IDOR Label Name Enumeration Persistent XSS Wiki Pages User Revokation Bypass with Mattermost Integration Arbitrary File Upload via Import Project...