mojoPortal 2.7.0.0 - Cross-Site Scripting Detection

mojoPortal 2.7.0.0 contains a cross-site scripting vulnerability in the FileDialog.aspx component, which can allow an attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters. !/usr/bin/env python3 -- coding: utf-8 -- """mojoPortal 2.""" from...

IceWarp 11.4.6.0 - Cross-Site Scripting Detection

IceWarp 11.4.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Quixplorer <=2.4.1 - Cross-Site Scripting Detection

Quixplorer through 2.4.1 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks...

Apache OFBiz 17.12.03 - Cross-Site Scripting Detection

Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz 17.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting Detection

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

Adiscon LogAnalyzer <4.1.7 - Cross-Site Scripting Detection

Adiscon LogAnalyzer before 4.1.7 contains a cross-site scripting vulnerability in the 'referer' parameter of the login.php file. !/usr/bin/env python3 -- coding: utf-8 -- """Adiscon LogAnalyzer before 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

SteVe - Cross-Site Scripting Detection

SteVe contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 --...

WordPress Checklist <1.1.9 - Cross-Site Scripting Detection

WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Checklist plugin before 1.""" from kittysploit import from...

Nordex NC2 - Cross-Site Scripting Detection

Nordex NC2 contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks...

IceWarp WebMail 11.3.1.5 - Cross-Site Scripting Detection

IceWarp WebMail 11.3.1.5 is vulnerable to cross-site scripting via the language parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebMail 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IceWarp...

Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting Detection

Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchange Server is vulnerable to a spoofing vulnerability.""" from kittysploit import from lib.protocols.http.httpclient...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the graph parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet contains a cross-site...

Pypiserver <1.2.5 - Carriage Return Line Feed Injection Detection

Pypiserver through 1.2.5 and below is susceptible to carriage return line feed injection. An attacker can set arbitrary HTTP headers and possibly conduct cross-site scripting attacks via a %0d%0a in a URI. !/usr/bin/env python3 -- coding: utf-8 -- """Pypiserver through 1.""" import re from...

WordPress Wordfence 7.4.6 - Cross0Site Scripting Detection

WordPress Wordfence 7.4.6 is vulnerable to cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Wordfence 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress Wordfence 7.4.6 -...

D-Link DIR-816L 2.x - Cross-Site Scripting Detection

D-Link DIR-816L devices 2.x before 1.10b04Beta02 contains a cross-site scripting vulnerability. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter before being printed on the webpage. An attacker can inject arbitrary script in the browser of an unsuspecting us...

Academy LMS 6.0 - Cross-Site Scripting Detection

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Creative Item Academy LMS 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Oracle Siebel Loyalty 8.1 - Cross-Site Scripting Detection

A vulnerability in Oracle Siebel Loyalty allows remote unauthenticated attackers to inject arbitrary Javascript code into the responses returned by the '/loyaltyenu/start.swe/' endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Oracle Siebel Loyalty allows remote...

Sickbeard - Cross-Site Scripting Detection

Sickbeard contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python...

SiteMinder - DOM Cross-Site Scripting Detection

SiteMinder contains a cross-site scripting vulnerability in the document object model. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Р7-Office 12.5 - Cross-Site Scripting Detection

A failure to implement proper measures to protect the structure of the web page in the P7-Office corporate server could have allowed a remote attacker to perform a cross-site scripting XSS attack. !/usr/bin/env python3 -- coding: utf-8 -- """A failure to implement proper measures to protect the...