Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the 1 action parameter in a search request, 2 username in a login request, which is not properly handled when logging the event, or 3 page titl...

HackerOne: Add text to the title of the page "Thanks"

Hi! We can add text to the title of the page "Thanks" Example: https://hackerone.com/mailru/thanks/2014%20Example%201111111111111111111111111...

Sites Powered By INVEM SQL Injection

+++++++++++++++++++++++++++++++++ + +Exploit Title : Invem CMS SQL INJECTION Vulnerability + +Exploit Author : Ashiyane Digital Security Team + +Vendor Homepage: http://www.invem.com/ + +Google Dork : intext:Powered by INVEM. + +Date : 20 / Jan / 2015 + +Tested On : windows se7en + linux Kali +...

CVE-2015-1040

Multiple cross-site scripting XSS vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lrealname field in the editProfile form to index.php/home/profile; the 2 datatitle or 3 datadescription field in the...

CVE-2014-9498

Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in the School Administration module 7.x-1.x before 7.x-1.8 for Drupal allows remote authenticated users with permission to create or edit a class node to inject arbitrary web script or HTML via a node title...

CVE-2014-9498

Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...

PHPDug has multiple cross-site scripting vulnerabilities

PHPDug is an open source social news site that supports sharing stories, news, images and more. PHPDug 2.0.0 suffers from multiple cross-site scripting vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the storyurl parameter to addstoryphp editprofilephp, and...

Multiple Cross-Site Scripting Vulnerabilities in SAP NetWeaver Business Client

SAP NetWeaver Business Client NWBC is a new-generation SAP client from SAP, which provides users with a single-sign-on entry point to SAP applications through a single user interface and serves as a browsing tool for applications such as SAP BSP, Web Dynpro and Portal. A cross-site scripting...

Multiple Cross-Site Scripting Vulnerabilities in Owl Intranet Knowledgebase

Owl Intranet Knowledgebase is a multi-user document management system. Multiple cross-site scripting vulnerabilities in Owl Intranet Knowledgebase 1.10 allow remote attackers to inject arbitrary web script or HTML via authentication by leveraging searches in the title field of browsephp or to...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/managerrelated.php in the administrative backend in Absolut Engine 1.73 allows remote authenticated users to inject arbitrary web script or HTML via the title parameter...

Sql injection

Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the 1 sectionID parameter to admin/managersection.php, 2 userID parameter to admin/edituser.php, 3 username parameter to admin/admin.php, or 4 title parameter to...

CVE-2014-9434

Cross-site scripting XSS vulnerability in admin/managerrelated.php in the administrative backend in Absolut Engine 1.73 allows remote authenticated users to inject arbitrary web script or HTML via the title parameter...

CVE-2011-5301

Multiple cross-site scripting XSS vulnerabilities in PHPDug 2.0.0 allow remote attackers to inject arbitrary web script or HTML via 1 the storyurl parameter to addstory.php, 2 the email parameter to editprofile.php, 3 the title parameter to adm/contentadd.php, or 4 the username parameter to...

CVE-2011-5301

Multiple cross-site scripting XSS vulnerabilities in PHPDug 2.0.0 allow remote attackers to inject arbitrary web script or HTML via 1 the storyurl parameter to addstory.php, 2 the email parameter to editprofile.php, 3 the title parameter to adm/contentadd.php, or 4 the username parameter to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in view.php in JCE-Tech PHP Video Script aka Video Niche Script 4.0 allow remote attackers to inject arbitrary web script or HTML via the 1 video or 2 title parameter...

Social Microblogging PRO 1.5 - Persistent Cross-Site Scripting

Social Microblogging PRO 1.5 - Persistent Cross-Site Scripting Exploit Title: Social Microblogging PRO 1.5 Stored XSS Vulnerability Date: 29-12-2014 Exploit Author: Halil Dalabasmaz Version: v1.5 Vendor Homepage: http://codecanyon.net/item/social-microblogging-pro/9217005 Tested on: Chrome &...

jetAudio 8.1.3.2200 Crash Proof Of Concept

Exploit Title : jetAudio 8.1.3.2200 Basic m3u Crash POC Product : jetAudio Basic Date : 27.12.2014 Exploit Author : Hadji Samir [email protected] Software Link : http://www.jetaudio.com/download/ Vulnerable version : 8.1.3.2200 Basic Vendor Homepage : http://www.jetaudio.com/ Tested on : Windows 7...

CVE-2013-4754

Multiple cross-site scripting XSS vulnerabilities in Owl Intranet Knowledgebase 1.10 allow remote authenticated users to inject arbitrary web script or HTML via 1 the Search field to browse.php or 2 the Title field to prefs.php...