6072 matches found
PT-2019-7859 · Fedora · Bodhi
Name of the Vulnerable Software and Affected Versions: Bodhi versions 2.9.0 and lower Description: The issue is related to cross-site scripting, which can result in code injection due to incorrect validation of bug titles. Recommendations: For Bodhi versions 2.9.0 and lower, update to a version...
Event Calendar 3.7.4 - id SQL Injection
Event Calendar 3.7.4 - id SQL Injection Exploit Title: Event Calendar 3.7.4 - SQL Injection Dork: N/A Date: 2019-01-10 Exploit Author: Ihsan Sencan Vendor Homepage: http://ezcode.pt/ Software Link: https://codecanyon.net/item/event-calendar-phpmysql-plugin/19246267 Version: 3.7.4 Category: Webapp...
Heatmiser Wifi Thermostat 1.7 - Cross-Site Request Forgery (Update Admin) Vulnerability
Exploit for hardware platform in category web applications Exploit Title: Heatmiser Wifi Thermostat 1.7 - Cross-Site Request Forgery Dork: intitle:"Heatmiser Wifi Thermostat" & you can use shodan Exploit Author: sajjadbnd Vendor Lnk: https://www.heatmiser.com/en/ Product Link:...
Embed Video Scripts - Persistent Cross-Site Scripting
Exploit Title: Embed Video Scripts - Cross-site Script stored Google Dork: N/A Date: 1 Jan 2019 Exploit Author: Deyaa Muhammad Author EMail: contact at deyaa.me Author Blog: http://deyaa.me POC Video: https://youtu.be/2CFJLwkxpT8 Vendor Homepage: https://codeawesome.in/embed/ Software Link:...
LayerBB 1.1.1 - Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: LayerBB 1.1.1 - Cross-Site Scripting Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://forum.layerbb.com/downloads.php?view=file&id=26 Version: 1.1.1 Tested on: Ubuntu 18.04 CVE: CVE-2018-17997 1...
phpMoAdmin MongoDB GUI 1.1.5 - Cross-Site Request Forgery / Cross-Site Scripting
Exploit Title: phpMoAdmin 1.1.5 - MongoDB GUI | Multiple Vulnerabilities Date: 03.01.2019 Exploit Author: Ozer Goker Vendor Homepage: http://www.phpmoadmin.com Software Link: http://www.phpmoadmin.com/file/phpmoadmin.zip Version: 1.1.5 Introduction phpMoAdmin - MongoDB GUI MongoDB administration...
CVE-2018-19903
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field...
CVE-2018-19903
This CVE concerns XSLT CMS, a PHP/XML/XSLT-based content management system. The vulnerability is a Persistent XSS flaw exploited through the title field in the create/?action=items.edit&type=Page endpoint, enabling injection of script/HTML. Root cause, per the description, is improper handling/es...
DouCo DouPHP Cross-Site Scripting Vulnerability (CNVD-2019-00999)
DouCo DouPHP is a lightweight open source CMS Content Management System based on PHP and MySQL. A cross-site scripting vulnerability exists in admin/article.php?rec=update in DouCo DouPHP version 1.5 20181221. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
Evolution CMS Cross-Site Scripting Vulnerability (CNVD-2019-03273)
Evolution CMS is a content management system CMS. A cross-site scripting vulnerability exists in Evolution CMS version 1.4.x, which can be exploited by remote attackers to inject arbitrary web script or HTML by sending the 'page weblink title' parameter to the manager/ URI...
Design/Logic Flaw
Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?tofield=id&popup=1 title parameter at admin/blog/blogpost/add/...
CVE-2018-16637
Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI...
CVE-2018-16632
Mezzanine CMS v4.3.1 is affected by CVE-2018-16632. The vulnerability is a Cross Site Scripting (XSS) flaw triggered via the title parameter in the admin/blog/blogcategory/add/ flow, specifically through the URL /admin/blog/blogcategory/add/?_to_field=id&_popup=1 on the related admin/blog/blogpos...
MAGIX Music Editor 3.1 Buffer Overflow
Exploit Title: MAGIX Music Editor 3.1 - Buffer Overflow SEH Exploit Author: bzyo Twitter: @bzyo Date: 2018-12-24 Vulnerable Software: MAGIX Music Editor 3.1 Vendor Homepage: https://www.magix.com/us/ Version: 3.1 Software Link: https://www.magix.com/us/music/mp3-deluxe/ Music Editor Software is...
WordPress Audio Record 1.0 Shell Upload
Exploit Title: WordPress Plugin Audio Record 1.0 - Arbitrary File Upload Date: 2018-12-24 Software Link: https://wordpress.org/plugins/audio-record/ Exploit Author: Kaimi Website: https://kaimi.io Version: 1.0 Category: webapps Unrestricted file upload in record upload process allowing arbitrary...
WSTMart 2.0.8 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications Exploit Title: WSTMart 2.0.8 - Cross-Site Request Forgery Add Admin Exploit Author: linfeng Vendor Homepage:https://github.com/wstmall/wstmart/ Software Link:http://www.wstmart.net/ Version: WSTMart 2.0.8181212 CVE :CVE-2018-19138 0x02 CSRF Po...
XMPlay 3.8.3 - '.m3u' Local Stack Overflow Code Execution
!/usr/bin/env python -- coding: utf-8 -- Exploit Title: XMPlay 3.8.3 - '.m3u' Code Execution PoC Date: 2018-12-19 Exploit Author: s7acktrac3 Vendor Homepage: https://www.xmplay.com/ Software Link: https://support.xmplay.com/filesview.php?fileid=676 Version: 3.8.3 latest Tested on: Windows XP SP3...
Bolt CMS < 3.6.2 - Cross-Site Scripting
Exploit Title: Bolt CMS https://github.com/rdincel1/Bolt-CMS-3.6.2---Cross-Site-Scripting/raw/master/bolt-v3.6.2.zip Affected Version: alert"Raif" Description Bolt CMS 3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry. PoC Video:...
MiniShare 1.4.1 - 'HEAD/POST' Remote Buffer Overflow
Not only the GET method is vulnerable to BOF CVE-2004-2271. HEAD and POST methods are also vulnerable. The difference is minimal, both are exploited in the same way. Only 1 byte difference: GET = 3, HEAD and POST = 4 length ------------------------------------------------------------------- EAX...