48 matches found
WordPress nd-booking Plugin Unauthorized Operation Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. nd-booking is an online reservation management plugin used in it. A security vulnerability exists in WordPress nd-booking plugin befor...
PT-2019-11778 · Cloudbees +1 · Jenkins
Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.191 and earlier Jenkins LTS versions 2.176.2 and earlier Description: A stored cross-site scripting issue allows attackers with Overall/Administer permission to inject arbitrary HTML and JavaScript in update center web page...
CVE-2019-10383: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages...
DiliCMS Cross-Site Scripting Vulnerability (CNVD-2019-07939)
DiliCMS is a content management system CMS based on Codelgniter. A cross-site scripting vulnerability exists in the site URL text box in DiliCMS version 2.4.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
CVE-2017-7783
If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...
CVE-2017-7783
If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...
ZZCMS 'siteurl' parameter PHP code injection vulnerability
ZZCMS is a CMS Content Management System used to quickly build Merchants type websites. A security vulnerability exists in ZZCMS version 8.2. The vulnerability can be exploited to inject PHP code by sending 'siteurl' parameter to install/index.php file...
CVE-2014-8492
Multiple cross-site scripting XSS vulnerabilities in assets/misc/fallback-page.php in the Profile Builder plugin before 2.0.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 sitename, 2 message, or 3 siteurl parameter...
PT-2017-6241
Name of the Vulnerable Software and Affected Versions Profile Builder plugin versions prior to 2.0.3 Description The issue allows remote attackers to inject arbitrary web script or HTML via the site name, message, or site url parameters in the assets/misc/fallback-page.php file. Recommendations F...
CVE-2017-7783
If a long user name is used in a username/password combination in a site URL such as " http://UserName:[email protected]", the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service. This vulnerability affects Firefox 55...
PT-2017-17941
Name of the Vulnerable Software and Affected Versions Firefox versions prior to 55 Description The issue occurs when a long user name is used in a username/password combination in a site URL, causing the resulting modal prompt to hang in a non-responsive state or crash. This results in a denial o...
lod2.inf.puc-rio.br XSS vulnerability
Vulnerable URL: http://lod2.inf.puc-rio.br/site/index.php?page=5;...
hru.gov XSS vulnerability
Open Bug Bounty ID: OBB-137716 Description| Value ---|--- Affected Website:| hru.gov Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
PT-2014-8876
Name of the Vulnerable Software and Affected Versions Morfy CMS version 1.05 Description The issue allows remote authenticated users to inject arbitrary PHP code into config.php via the site url parameter in install.php. Recommendations For Morfy CMS version 1.05, avoid using the site url paramet...
PHPLinks 2.1.2 Add Site HTML Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/6632/info phpLinks is prone to HTML injection. phpLinks does not sufficiently sanitized HTML and script code supplied via form fields before displaying this data to administrative users. This issue exists in the 'add.php'...
NooMS CMS 1.1.1 - CSRF
No description provided by source. NooMS CMS version 1.1.1 CSRF Bug Found: April 9th 2011 Found by: loneferret as far as I know anyway Software Download Link: http://phpkode.com/download/p/2381nooms1.1.1.tar.bz2 Nods to exploit-db Team Well, I didn't have much to do this morning so figured I'd tr...
PT-2014-2442
Name of the Vulnerable Software and Affected Versions ownCloud versions prior to 4.0.12 ownCloud versions 4.5.x prior to 4.5.7 Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved via the site name or site url parameter to t...
2B.COM sprl SQL Injection
2B.COM sprl = SQL Injection Vulnerability ======================================================== .:. Author : Metropolis .:. Home : http://metropolis.fr.cr .:. Script : 2B.COM sprl .:. Version : N/A .:. Dork : inurl:/php/index.php?docid= .:. Bug Type : Sql Injection === Exploit ===...
WordPress Plugin A to Z Category Listing 1.3 - SQL Injection
Exploit Title: WordPress A to Z Category Listing plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0--%20 --------------- Vulnerable code --------------- $initletter = $GET'R'; $sql = "select from ".$tableprefix."terms wpt,".$tableprefix."termtaxonomy wptt where wpt.name like...
Mozilla Firefox出错消息脚本文件名信息泄露漏洞
BUGTRAQ ID: 41860 CVE ID: CVE-2010-2754 Firefox是一款流行的开源WEB浏览器。 Firefox中的脚本出错处理方式会显示错误的来源，其中可能包含有敏感信息。假设 http://SampleSite.com/admin.asp 页面使用了以下逻辑： 1- 如果用户没有登录，重新定向到登录页面。 2- 如果用户不是管理员，重新定向到拒绝访问页面。 3- 如果用户为管理员，显示管理员菜单。 攻击者可以使用跨站URL劫持技术确认用户在SampleSite.com所处的状态，并继续执行有针对性的攻击。 Mozilla Firefox 3.6.x...