Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the...

McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting Detection

McAfee ePolicy Orchestrator before 5.10.9 Update 9 is vulnerable to a cross-site scripting vulnerability that allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. reference: -...

ElasticSearch v1.1.1/1.2 RCE Detection

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atma...

WWBN AVideo 11.6 - Cross-Site Scripting Detection

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'msg' parameter, which is inserted into the document with insufficient sanitization. !/usr/bin/env python3 -- coding: utf-8 -- """WWBN AVideo 11.""" from kittysploit import from...

Haraj 3.7 - Cross-Site Scripting Detection

Haraj 3.7 contains a cross-site scripting vulnerability in the User Upgrade Form. An attacker can inject malicious script and thus steal authentication credentials and launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Haraj 3.""" from kittysploit import from...

Adobe ColdFusion - Cross-Site Scripting Detection

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

WordPress Adaptive Images < 0.6.69 - Cross-Site Scripting Detection

WordPress Adaptive Images 0.6.69 is susceptible to cross-site scripting because the plugin does not sanitize and escape the REQUESTURI before outputting it back in a page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Adaptive Images 0.""" from kittysploit import from...

Apereo CAS Cross-Site Scripting Detection

Apereo CAS through 6.4.1 allows cross-site scripting via POST requests sent to the REST API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Apereo CAS through 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

XWiki >= 2.5-milestone-2 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as:...

SolarView Compact 6.00 - Cross-Site Scripting Detection

SolarView Compact 6.00 contains a cross-site scripting vulnerability via SolarAiConf.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

WordPress WPB Show Core - Cross-Site Scripting Detection

WordPress wpb-show-core plugin through TODO contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site...

mojoPortal 2.7.0.0 - Cross-Site Scripting Detection

mojoPortal 2.7.0.0 contains a cross-site scripting vulnerability in the FileDialog.aspx component, which can allow an attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters. !/usr/bin/env python3 -- coding: utf-8 -- """mojoPortal 2.""" from...

Jolokia 1.3.7 - Cross-Site Scripting Detection

Jolokia 1.3.7 is vulnerable to cross-site scripting in the HTTP servlet and allows an attacker to execute malicious JavaScript in the victim's browser. !/usr/bin/env python3 -- coding: utf-8 -- """Jolokia 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

DokuWiki - Cross-Site Scripting Detection

DokuWiki through 2017-02-19b contains a cross-site scripting vulnerability in the DATEAT parameter to doku.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Samsung WLAN AP WEA453e - Cross-Site Scripting Detection

Samsung WLAN AP WEA453e router contains a cross-site scripting vulnerability. An attacker can execute arbitrary script and thus steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung WLAN AP WEA453e router contains a cross-site...

Academy Learning Management System <5.9.1 - Cross-Site Scripting Detection

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Adobe ColdFusion - Cross-Site Scripting Detection

Adobe ColdFusion debug page contains a cross-site scripting vulnerability when the application is running on a remote host. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Cacti - Cross-Site Scripting Detection

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti contains a cross-site scripting vulnerability via...

Jenkins build-metrics 1.3 - Cross-Site Scripting Detection

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins build-metrics 1.""" from kittysploit import from...