CVE-2017-15948: Improper Neutralization of Input During Web Page Generation

Perch Content Management System 3.0.3 allows unrestricted file upload with resultant XSS via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account...

PT-2017-14305

Name of the Vulnerable Software and Affected Versions Perch Content Management System version 3.0.3 Description The issue allows for unrestricted file upload, which can lead to cross-site scripting XSS attacks. This can be exploited by using the Asset Title field in conjunction with the Select Fi...

FS Shutter Stock Clone SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: FS Shutter Stock Clone - 'keywords' SQL Injection Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/shutterstock-clone/ Version: 24 October 17 Tested on: Kali...

FS Monster Clone SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: FS Monster Clone - 'id' SQL Injection Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/monster-clone/ Version: 24 October 17 Tested on: Kali Linux 2.0 | Mac O...

FS Crowdfunding Script SQL Injection

Exploit Title: FS Crowdfunding Script - 'id' SQL Injection Date: 2017-10-24 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/crowdfunding-script/ Version: 24 October 17 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email:...

GHSA-WCM2-9C89-WMFM Cross-site Scripting in jquery-ui

Cross-site scripting XSS vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option...

jquery-ui Tooltip widget vulnerable to XSS

Cross-site scripting XSS vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo...

GHSA-QQXP-XP9V-VVX6 jquery-ui Tooltip widget vulnerable to XSS

Cross-site scripting XSS vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo...

Cross-site Scripting in jquery-ui

Cross-site scripting XSS vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option...

Moderate severity vulnerability that affects jquery-ui

Cross-site scripting XSS vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo...

FS Monster Clone - 'id' SQL Injection

Exploit Title: FS Monster Clone - 'id' SQL Injection Date: 2017-10-24 Exploit Author: 8bitsec Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/monster-clone/ Version: 24 October 17 Tested on: Kali Linux 2.0 | Mac OS 10.12.6 Email: [email protected]...

CVE-2017-15648

In PHPSUGAR PHP Melody before 2.7.3, pagemanager.php has XSS via the pagetitle parameter...

PT-2017-14140

Name of the Vulnerable Software and Affected Versions PHPSUGAR PHP Melody versions prior to 2.7.3 Description The issue concerns an XSS vulnerability via the page title parameter in the page manager.php file. Recommendations For versions prior to 2.7.3, update to version 2.7.3 or later to resolve...

Wordpress Car Park Booking Plugin - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Car Park Booking - SQL Injection Exploit Author: 8bitsec Vendor Homepage: https://codecanyon.net/item/car-park-booking-wordpress-plugin/20284035 Software Link:...

TYPO3 Extension Restler 1.7.0 - Local File Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: Typo3 Restler Extension - Local File Disclosure Date: 2017-10-13 Exploit Author: CrashBandicot @dosperl Vendor Homepage: https://www.aoe.com/ Software Link: https://extensions.typo3.org/extension/restler/ Tested on : MsWin...

dotCMS Stored Cross-Site Scripting Vulnerability

dotCMS is a content management system CMS from the United States dotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build features . A cross-site scripting vulnerability exists in the vanity-urls Title field in dotCMS version 4.1.1, which originat...

Cross site scripting

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

CVE-2017-15219

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...

PT-2017-13914

Name of the Vulnerable Software and Affected Versions dotCMS version 4.1.1 Description The issue affects the dotCMS application, where a Stored Cross-Site Scripting XSS vulnerability is present. This vulnerability impacts the Title field of vanity-urls, the Description field of containers, and th...

CVE-2017-15219: Improper Neutralization of Input During Web Page Generation

The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting XSS affecting a vanity-urls Title field, a containers Description field, and a templates Description field...