Monstra CMS Cross-Site Scripting Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the 'title' function of the plugins/box/pages/pages.plugin.php...

Joomla! Zh GoogleMap 8.4.0.0 SQL Injection

input name="id" value="-11 UNION ALL SELECT...

Joomla Zh BaiduMap 3.0.0.1 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications input name="id" value="-11 UNION ALL SELECT...

Joomla Zh GoogleMap 8.4.0.0 Component - SQL Injection Vulnerability

Exploit for php platform in category web applications input name="id" value="-11 UNION ALL SELECT...

Joomla! Component JSP Tickets 1.1 - SQL Injection

Joomla! Component JSP Tickets 1.1 - SQL Injection Exploit Title: Joomla! Component JSP Tickets 1.1 - SQL Injection Dork: N/A Date: 04.02.2018 Vendor Homepage: http://joomlaserviceprovider.com/ Software Link:...

Design/Logic Flaw

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

CVE-2018-6550

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

CVE-2018-6550

CVE-2018-6550 affects Monstra CMS up to version 3.0.4, where an XSS flaw exists in the title handling of plugins/box/pages/pages.plugin.php that can be triggered via a crafted page title sent to admin/index.php. Public sources consistently describe an XSS in the title function, with potential imp...

Cross-site Scripting (XSS)

Kibana is vulnerable to cross-site scripting XSS attacks. This is because the visualization title is enabled in render function of visualizeembeddablefactory.js which allows an attacker to inject and execute arbitrary webscript...

ok.ru: Хранимая XSS в личных сообщениях новое место

Stored XSS in chat title at https://ok.ru/messages...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2018-02622)

CMS Made Simple is a simple, easy-to-use content management system developed using PHP, MySQL and Smarty template engines. A cross-site scripting vulnerability exists in CMS Made Simple CMSMS 2.2.5. The vulnerability can be exploited to conduct cross-site scripting attacks via the title parameter...

Code injection

CMS Made Simple CMSMS 2.2.5 has XSS in admin/addbookmark.php via the title parameter...

CVE-2018-5963

CMS Made Simple CMSMS 2.2.5 has XSS in admin/addbookmark.php via the title parameter...

CVE-2018-5963

CMS Made Simple CMSMS 2.2.5 has XSS in admin/addbookmark.php via the title parameter...

CVE-2018-5963

CMS Made Simple CMSMS 2.2.5 has XSS in admin/addbookmark.php via the title parameter...

Flexible Poll 1.2 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Flexible Poll 1.2 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://ddywpro.com/ Software Link: https://codecanyon.net/item/flexible-poll/4363114 Version: 1.2 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CV...

Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for php platform in category web applications New Admin Username: Password: Confirm Password: Email: $"ekleabi".live'click',function $.ajax type: "POST", url: "http://ronnieswietek.com/cc/clients/resources/ajax/ajaxnewadmin.php", data: username:$".efe username".val,...

Wchat 1.5 SQL Injection

Exploit Title: Wchat - Fully Responsive PHP AJAX Chat Script 1.5 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://bylancer.com/ Software Link: https://codecanyon.net/item/wchat-fully-responsive-phpajax-chat/18047319 Version: 1.5 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

Professional Local Directory Script 1.0 SQL Injection

Exploit Title: Professional Local Directory Script 1.0 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://www.eihitech.com/ Software Link: http://www.eihitech.com/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: CVE-2018-5973 Exploit Author: Ihsan Sencan Author...

Professional Local Directory Script 1.0 - SQL Injection

Professional Local Directory Script 1.0 - SQL Injection Exploit Title: Professional Local Directory Script 1.0 - SQL Injection Dork: N/A Date: 23.01.2018 Vendor Homepage: http://www.eihitech.com/ Software Link: http://www.eihitech.com/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx6...