WordPress SagePay Server Gateway for WooCommerce <1.0.9 - Cross-Site Scripting Detection

WordPress SagePay Server Gateway for WooCommerce before 1.0.9 is vulnerable to cross-site scripting via the includes/pages/redirect.php page parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress SagePay Server Gateway for WooCommerce before 1.""" from kittysploit import from...

SugarCRM 3.5.1 - Cross-Site Scripting Detection

SugarCRM 3.5.1 is vulnerable to cross-site scripting via phprint.php and a parameter name in the query string aka a $key variable. !/usr/bin/env python3 -- coding: utf-8 -- """SugarCRM 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS) Detection

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

Cloudron 6.2 Cross-Site Scripting Detection

In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """In Cloudron 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cloudron 6....

Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting Detection

Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchange Server is vulnerable to a spoofing vulnerability.""" from kittysploit import from lib.protocols.http.httpclient...

myfactory FMS - Cross-Site Scripting Detection

myfactory.FMS before 7.1-912 allows cross-site scripting via the Error parameter. !/usr/bin/env python3 -- coding: utf-8 -- """myfactory.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'myfactory FMS - Cross-Site...

WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting Detection

WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the...

Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting Detection

The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting. !/usr/bin/env python3 -- coding: utf-8 -- """The Redirection for Contact Form 7 WordPress plugin before 2.""" from...

WordPress Ad Inserter <2.7.10 - Cross-Site Scripting Detection

WordPress Ad Inserter plugin before 2.7.10 contains a cross-site scripting vulnerability. It does not sanitize and escape the htmlelementselection parameter before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Ad Inserter plugin before 2.""" from kittysplo...

WordPress WP JobSearch <1.5.1 - Cross-Site Scripting Detection

WordPress WP JobSearch plugin prior to 1.5.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

Microweber < 1.2.17 - Cross-Site Scripting Detection

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter.""" from kittysploit import from...

Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atma...

SolarView Compact 6.00 - Cross-Site Scripting Detection

SolarView Compact 6.00 contains a cross-site scripting vulnerability via SolarAiConf.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

WWBN AVideo 11.6 - Cross-Site Scripting Detection

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'msg' parameter, which is inserted into the document with insufficient sanitization. !/usr/bin/env python3 -- coding: utf-8 -- """WWBN AVideo 11.""" from kittysploit import from...

Helmet Store Showroom - Cross Site Scripting Detection

Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting XSS. !/usr/bin/env python3 -- coding: utf-8 -- """Helmet Store Showroom 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Helmet Store Showroom - Cross...

XWiki >= 2.5-milestone-2 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as:...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Apereo CAS Cross-Site Scripting Detection

Apereo CAS through 6.4.1 allows cross-site scripting via POST requests sent to the REST API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Apereo CAS through 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Reprise License Manager 14.2 - Cross-Site Scripting Detection

Reprise License Manager 14.2 contains a cross-site scripting vulnerability in the /goform/activateprocess "count" parameter via GET. !/usr/bin/env python3 -- coding: utf-8 -- """Reprise License Manager 14.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting Detection

WordPress Shortcodes and extra features plugin for the Phlox theme before 2.9.8 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting...