12856 matches found
Exploit for Cross-site Scripting in Cloudogu Scm_Manager
CVE-2023-33829: Stored-XSS-on-SC...
Exploit for Cross-site Scripting in Cloudogu Scm_Manager
CVE-2023-33829: Stored-XSS-on-SC...
Exploit for Improper Input Validation in Microsoft
CVE-2023-21554-PoC CVE-2023-21554 is a Windows MessageQueuin...
Contact Form Email < 1.3.38 - Unauthenticated Stored Cross-Site Scripting
The plugin does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability. PoC 1. Publish the default form to a page by clicking on "Contact Form to Email" in the sidebar, and the "Publish" button beside the form name. 2. Visit the form on the frontend...
vm2 Sandbox Escape vulnerability
A sandbox escape vulnerability exists in vm2 for versions up to 3.9.17. It abuses an unexpected creation of a host object based on the specification of Proxy. Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. Patches Thi...
Stop Spammers Security < 2023 - Reflected XSS
The plugin does not sanitise and escape various parameters before outputting them back in admin dashboard pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page containing the code below...
Stop Spammers Security < 2023 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the payload below in any of the "Challenge...
Epson Stylus SX510W Denial Of Service
Exploit Title: Epson Stylus SX510W Printer Remote Power Off - Denial of Service PoC Discovery by: Rafael Pedrero Discovery Date: 2020-05-16 Vendor Homepage: https://www.epson.es/ Software Link : https://www.epson.es/products/printers/inkjet-printers/for-home/epson-stylus-sx510w Tested Version:...
Exploit for Improper Authentication in Wpdeveloper Essential_Addons_For_Elementor
CVE-2023-32243 Essential Addons for Elementor - Unauthorized...
Exploit for CVE-2022-24481
CVE-2022-24481-POC TL;DR This poc is reversed from expSHA...
Get Your Number <= 1.1.3 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. In the plugin's settings, enter the payload...
RockMongo 1.1.7 - Stored Cross-Site Scripting Vulnerability
Exploit Title: RockMongo 1.1.7 - Stored Cross-Site Scripting XSS Discovery by: Rafael Pedrero Vendor Homepage: https://github.com/iwind/rockmongo/ Software Link : https://github.com/iwind/rockmongo/ Tested Version: 1.1.7 Tested on: Windows 7 and 10 Vulnerability Type: Stored Cross-Site Scripting...
10WebSocial < 1.2.9 - Reflected XSS
The plugin does not sanitise and escape some parameter before outputting it back in a page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page with the code below The XSS will be triggered when pressing...
Directorist < 7.5.4 - Admin+ LFI
The plugin is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files. PoC This PoC will work on Linux systems. 1. Navigate to the URL path: /wp-admin/edit.php?posttype=atbizdir=tools=2=/etc/passwd=; 2.. You will be presented with the first couple...
Directorist < 7.5.4 - Admin+ LFI
The plugin is vulnerable to Local File Inclusion as it does not validate the file parameter when importing CSV files. This PoC will work on Linux systems. 1. Navigate to the URL path: /wp-admin/edit.php?posttype=atbizdir&page=tools&step=2&file=/etc/passwd&delimiter=; 2.. You will be presented wit...
Ruby: XSS exploit of RDoc documentation generated by rdoc (CVE-2013-0256)
Vulnerability description not provided...
Stored XSS in module name "Edit Link"
Description I noticed that you filtered the input very carefully. But there are still some parts you missed Proof of Concept 1.Login in URL : https://demo.pimcore.fun/admin. 2.Go to "Search Documents" and filter only "Snippet" search and press search. 3.Go to "/en/shared/teasers/Popular Brands"...
Exploit for CVE-2021-46703
CVE-2021-46703 Simple payload builder based on POC in: https:/...
Stored XSS in module name "Search Documents"
Description The search documents function was infected with xss because the title payload was not filtered resulting in xss when searching to /de. Proof of Concept 1.Go to edit page title /de 2.Enter this xss code 3.Go to "Search Documents" and type in "77" search box to find /de -- xss will be...