1320 matches found
HackerOne: Query parameter reordering causes redirect page to render unsafe URL
Hello hackerone team I want to report I bypass w/c lead to XSS but limited only for IE due to CSP block on chrome Here is the POC ------------------ https://hackerone.com/redirect?signature=c9304cadaeabca0bfb7b92503c0318da5c42a86b&url=http%3A%2F%2Fbuglabs.me&url=JAVASCRIPT:alert%09document.domain...
Multiple Cross-Site Scripting Vulnerabilities in WordPress WpJobBoard
WordPress WpJobBoard is a job panel plugin for WordPress. wpjb-email, wpjb-job, wpjb-application, and wpjb-membership are components of it. wpjb-email is an email component. wpjb- job is a job management component. Multiple cross-site scripting vulnerabilities exist in the 'query' and 'id'...
CVE-2017-15375: Improper Neutralization of Input During Web Page Generation
Multiple client-side cross site scripting vulnerabilities have been discovered in the WpJobBoard v4.5.1 web-application for WordPress. The vulnerabilities are located in the query and id parameters of the wpjb-email, wpjb-job, wpjb-application, and wpjb-membership modules. Remote attackers are ab...
CVE-2017-15063
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...
Cross site request forgery (csrf)
There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing for example an attack against the query parameter to panel/database...
finesthotels.net XSS vulnerability
Vulnerable URL: https://www.finesthotels.net/en/hotel-offers/offers.html?query=STOPSENDINGMESPAM=alert/OPENBUGBOUNTY/...
CVE-2017-12798
Cross-Site Scripting XSS exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php...
Cross site scripting
Cross-site scripting XSS vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php...
CVE-2015-3998
phpwhois version 4.2.5 used in the WordPress adsense-click-fraud-monitoring plugin version 1.7.5 is documented to have a cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary script or HTML via the query parameter to whois.php. The linked reports confirm the affected componen...
CVE-2015-3998: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php...
uit.no XSS vulnerability
Vulnerable URL: https://uit.no/finn?q=1"--...
CVE-2017-3161
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
CVE-2017-3162
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0...
CVE-2017-3161
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
CVE-2017-3162: Improper Input Validation
HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0...
CVE-2017-3161: Improper Neutralization of Input During Web Page Generation
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
Subrion CMS SQL Injection Vulnerability
Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A SQL injection vulnerability exists in the admin/database/ URI in Subrion CMS version 4.0.5.10. A remote...
CVE-2017-6013
Subrion CMS 4.0.5.10 has SQL injection in admin/database/ via the query parameter...