Cross site scripting

Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting XSS, allowing attackers to register as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields...

CVE-2022-30003

Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting XSS, allowing attackers to register as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields...

PT-2022-21619 · Rdiffweb · Rdiffweb

Name of the Vulnerable Software and Affected Versions: rdiffweb versions prior to 2.4.8 Description: The issue is related to the allocation of resources without limits or throttling, which can lead to a Denial of Service DoS attack. Specifically, an unlimited length "title" field when adding an S...

Active eCommerce CMS 6.3.0 Arbitrary File Download

Exploit Title: Active eCommerce CMS Arbitrary File Download Exploit Author: th3d1gger Vendor Homepage: https://codecanyon.net Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405 Version: Version 6.3.0 Tested on Ubuntu 18.04 without authentication with for loop user can downlo...

WordPress Plugin Image Hover Effects Ultimate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

YetiForceCrm 跨站脚本漏洞

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A cross-site scripting vulnerability exists in versions of YetiForceCrm prior to 6.3, which stems from an unvalidated title parameter on the WidgetsManagement module in Settings and is used directly in...

Craft CMS Stored Cross-site Scripting in User Addresses Title

Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting XSS in /admin/myaccount...

Stored Cross-Site Scripting (XSS) on Schedule Maintenance "Title" parameter

Description Stored Cross-Site Scripting XSS vulnerability in LibreNMS v22.8.0 allows attackers to execute arbitrary javascript code in the browser affected from function of "Schedule Maintenance" in "Title" parameter. Proof of Concept 1 - Click "Alerts" Click "Schedule Maintenance" from the...

CVE-2022-37796

In Simple Online Book Store System 1.0 in /adminbook.php the Title, Author, and Description parameters are vulnerable to Cross Site ScriptingXSS...

CVE-2022-37796

In Simple Online Book Store System 1.0 in /adminbook.php the Title, Author, and Description parameters are vulnerable to Cross Site ScriptingXSS...

Simple Online Book Store System 跨站脚本漏洞

Simple Online Book Store System is a simple online bookstore system by Carlo Montero, an individual developer. A security vulnerability in the Title, Author, and Description parameters of the adminbook.php file in Simple Online Book Store System version 1.0 can be exploited to cause cross-site...

SmartRG Router 2.6.13 Remote Code Execution

Exploit Title: SmartRG Router - Remote Code Execution Date: 13/06/2022 Exploit Author: Yerodin Richards Vendor Homepage: https://adtran.com Version: 2.5.15 / 2.6.13 confirmed Tested on: SR506n 2.5.15 & SR510n 2.6.13 CVE : CVE-2022-37661 import requests from subprocess import Popen, PIPE routerhos...

PT-2022-24074 · Unknown · Simple Online Book Store System

Name of the Vulnerable Software and Affected Versions: Simple Online Book Store System version 1.0 Description: The issue concerns Cross Site Scripting XSS in the /admin book.php file, where the Title, Author, and Description parameters are vulnerable. This allows for potential malicious script...

PT-2022-17107 · WordPress · Visual Composer Website Builder

Name of the Vulnerable Software and Affected Versions: Visual Composer Website Builder plugin for WordPress versions up to, and including, 45.0 Description: The issue is related to Stored Cross-Site Scripting via the post/page Title value due to insufficient input sanitization and output escaping...

PT-2022-14013 · WordPress · Simple Seo

Name of the Vulnerable Software and Affected Versions: Simple SEO plugin for WordPress versions up to, and including 1.7.91 Description: The issue is related to attribute-based stored Cross-Site Scripting due to insufficient sanitization or escaping on the SEO social and standard title parameters...

Discourse-Chat 安全漏洞

Discourse-Chat is a free open source chat plugin for Discourse open source internet forum software. A security vulnerability exists in versions of Discourse-Chat prior to 0.9, which originated from a cross-site scripting XSS attack by an administrator user inserting HTML in the chat title and...

Online Market Place Site 1.0 Cross Site Scripting

Exploit Title: Online Market Place Site v1.0 - Stored Cross-Site Scripting XSS Exploit Author: Joe Pollock Date: September 03, 2022 Vendor Homepage: https://www.sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html Software Link:...

Visual Composer Website Builder < 45.0.1 - Authenticated Stored XSS via Title

The plugin does not sanitise and escape post/page Title, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks Create a post using the plugin editor and add the following payload in the Title: " The XSS will be triggered when editing the post again...

Visual Composer Website Builder < 45.0.1 - Authenticated Stored XSS via Title

The plugin does not sanitise and escape post/page Title, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks PoC Create a post using the plugin editor and add the following payload in the Title: " The XSS will be triggered when editing the post again...

Jfinal Cross-site Scripting vulnerability

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...