WordPress JSmol2WP <=1.07 - Cross-Site Scripting Detection

WordPress JSmol2WP version 1.07 and earlier is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the jsmol.php data parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress JSmol2WP version 1.""" from kittysploit import from...

WP-FaceThumb 0.1 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in index.php in the WP-FaceThumb plugin 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the paginationwpfacethumb parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in index.""" fro...

ElasticSearch v1.1.1/1.2 RCE Detection

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting Detection

WordPress HDW Video Gallery 1.2 and before contains a cross-site scripting vulnerability via mychannel.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Aruba Airwave <8.2.3.1 - Cross-Site Scripting Detection

Aruba Airwave before version 8.2.3.1 is vulnerable to reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Aruba Airwave before version 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Aruba...

Sympa version =>6.2.16 - Cross-Site Scripting Detection

Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs. !/usr/bin/env python3 -- coding: utf-8 -- """Sympa version 6.""...

Zend Server <9.13 - Cross-Site Scripting Detection

Zend Server before version 9.13 is vulnerable to cross-site scripting via the debughost parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Zend Server before version 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Monstra CMS <=3.0.4 - Cross-Site Scripting Detection

Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

Linear eMerge E3 - Cross-Site Scripting Detection

Linear eMerge E3-Series devices are vulnerable to cross-site scripting via the 'layout' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Linear eMerge E3-Series devices are vulnerable to cross-site scripting via the 'layout' parameter.""" from kittysploit import from...

McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting Detection

McAfee ePolicy Orchestrator before 5.10.9 Update 9 is vulnerable to a cross-site scripting vulnerability that allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. reference: -...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Accela Civic Platform <=21.1 - Cross-Site Scripting Detection

Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via the security/hostSignon.do parameter servProvCode. !/usr/bin/env python3 -- coding: utf-8 -- """Accela Civic Platform through 21.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Avaya Aura Utility Services Administration - Cross-Site Scripting Detection

Avaya Aura Utility Services Administration contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch oth...

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the...

TP-Link Archer A20 v3 Router - Cross-site Scripting Detection

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

OpenCMS - Cross-Site Scripting Detection

OpenCMS below 10.5.1 is vulnerable to Cross-Site Scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """OpenCMS below 10.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenCMS - Cross-Site Scripting...

Trilium <0.52.4 - Cross-Site Scripting Detection

Trilium prior to 0.52.4, 0.53.1-beta contains a cross-site scripting vulnerability which can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Trilium prior to 0.""" from...

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting Detection

Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the indexen.php 'from' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Parallels H-Sphere 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

FortiWeb - Cross Site Scripting Detection

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. !/usr/bin/env python3 -- coding:...

WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting Detection

WordPress Simple Giveaways plugin before 2.36.2 contains a cross-site scripting vulnerability via the method and share GET parameters of the Giveaway pages, which are not sanitized, validated, or escaped before being output back in the pages. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...