Cross-site Scripting (XSS)

github.com/koding/koding is vulnerable to cross-site scripting XSS attacks. The attacks exist since it does not encode the user input value in crawler to avoid the attack...

Cross-site Scripting (XSS)

github.com/koding/koding is vulnerable to cross-site scripting XSS attacks. The vulnerability exists because Encoder.XSSEncode is not applied on user input...

Remote Code Execution (RCE)

growl is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the exec function...

Remote Code Execution (RCE)

protojs is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function. Note: An incomplete fix is introduced in 1.0.5...

Remote Code Execution

mongo-parse is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

Remote Code Execution (RCE)

kmc is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

Remote Code Execution (RCE)

mongo-edit is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

Remote Code Execution (RCE)

mongui is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

Remote Code Execution (RCE)

mongoosify is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

Remote Code Execution (RCE)

modulify is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code by passing a file to the system due to a lack of sanitization of user input before executing the eval function...

Remote Code Execution (RCE)

modjs is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

Remote Code Execution (RCE)

nd-validator is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

Remote Code Execution (RCE)

m2m-supervisor is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

Remote Code Execution (RCE)

mobile-icon-resizer is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...

U.S. Dept Of Defense: reflected xss @ www.█████████

Summary: https://www.██████████/█████████is vulnerable to cross site scripting attacks. PoC Sending the following POST request to /█████ triggers the xss:...

Cross-site Scripting (XSS)

github.com/gogits/gogs is vulnerable cross-site scripting XSS attacks. The library does not sanitize its user input, allowing a malicious user to inject and execute arbitrary JavaScript...

Arbitrary File Traversal Vulnerability in Ampcom Application Gateway

Ambient Application Gateway is an inter-network device developed by Beijing Ambient Technology Co., Ltd. to interconnect one network with another and provide specific applications. An arbitrary file traversal vulnerability exists in the ABT Application Gateway. An attacker can use user-controllab...

Logrhythm Network Monitor Multiple Vulnerabilities

Logrhythm Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WordPress Plugin WA Form Builder SQL Injection

Description: Type user access: any user. $POST ‘waformsId’ is not escaped. WAFormBuilderuioutput is accessible for any user. File / Code: Path: /wp-content/plugins/wa-form-builder/main.php global $wpdb; echo 'SELECT FROM '.$wpdb-prefix.'wapwaformbuilder WHERE Id = '.$REQUEST'waformsId'; $formattr...

WordPress Plugin Nelio AB Testing Server-Side Request Forgery (SSRF)

Case Study: SSRF in Nelio AB Testing WordPress Plugin Nelio AB Testing is a WordPress plugin used for A/B Testing in WordPress pages. We can download the source-code of the Plugin from plugins.svn.wordpress.org/nelio-ab-testing/tags/4.5.8/. Server-side Request Forgery SSRF is a vulnerability wher...