17115 matches found
Viessmann Vitogate 300 - Remote Code Execution
In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method. id: CVE-2023-45852 info: name: Viessmann Vitogate 300 - Remote Code Execution autho...
WordPress Yuzo <5.12.94 - Cross-Site Scripting
WordPress Yuzo Related Posts plugin before 5.12.94 is vulnerable to cross-site scripting because it mistakenly expects that isadmin verifies that the request comes from an admin user it actually only verifies that the request is for an admin page. An unauthenticated attacker can consequently inje...
DokuWiki - Cross-Site Scripting
DokuWiki through 2017-02-19b contains a cross-site scripting vulnerability in the DATEAT parameter to doku.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...
WordPress JNews Theme <8.0.6 - Cross-Site Scripting
WordPress JNews theme before 8.0.6 contains a reflected cross-site scripting vulnerability. It does not sanitize the catid parameter in the POST request /?ajax-request=jnews with action=jnewsbuildmegacategory. id: CVE-2021-24342 info: name: WordPress JNews Theme =8.0.6 to mitigate the XSS...
Membership Database <= 1.0 - Cross-Site Scripting
Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...
WBCE CMS v1.5.4 - Cross Site Scripting (Stored)
A cross-site scripting XSS vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field. id: CVE-2022-45037 info: name: WBCE CMS v1.5.4 - Cross Site Scripting Stored author:...
Label Studio < 1.16.0 - Cross-Site Scripting
Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...
OpenCATS 0.9.6 - Cross-Site Scripting
OpenCATS 0.9.6 contains a cross-site scripting vulnerability via the joborderID parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...
MAGMI - Cross-Site Request Forgery
MAGMI Magento Mass Importer is vulnerable to cross-site request forgery CSRF due to a lack of CSRF tokens. Remote code execution via phpcli command is also possible in the event that CSRF is leveraged against an existing admin session. id: CVE-2020-5776 info: name: MAGMI - Cross-Site Request...
Kavita <0.5.4.1 - Server-Side Request Forgery
Kavita before 0.5.4.1 is susceptible to server-side request forgery in GitHub repository kareadita/kavita. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-2756 info: name:...
Bank Locker Management System - Cross-Site Scripting
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate...
phpIPAM - 1.6 - Cross-Site Scripting
phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...
WBCE CMS v1.5.4 - Cross Site Scripting (Stored)
A cross-site scripting XSS vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field. id: CVE-2022-45038 info: name: WBCE CMS v1.5.4 - Cross Site Scripting Stored author:...
Seo Panel 4.8.0 - Cross-Site Scripting
Seo Panel 4.8.0 contains a reflected cross-site scripting vulnerability via the seo/seopanel/login.php?sec=forgot email parameter. id: CVE-2021-3002 info: name: Seo Panel 4.8.0 - Cross-Site Scripting author: edoardottt severity: medium description: Seo Panel 4.8.0 contains a reflected cross-site...
MindPalette NateMail 3.0.15 - Cross-Site Scripting
MindPalette NateMail 3.0.15 is susceptible to reflected cross-site scripting which could allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note...
WebGoat.NET
Webgoat.NET Código fuente: https://github.com/jerryhoff/WebGoat.NET Descargar zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master Esta aplicación web es una plataforma de aprendizaje que intenta enseñar sobre fallos comunes de seguridad web. Contiene fallos de seguridad genéricos que...
2018-QWB-CTF
2018-QWB-CTF 2018 Qiangwang Cup CTFRecopilación de retos root@kitploit: │ ├── 01Misc-4题 │ ├── 题目名称：ai-nimals │ │ └── 题目名称：ai-nimals.mhtml │ ├── 题目名称：welcome │ │ └── 题目名称：welcome.mhtml │ ├── 题目名称：签到 │ │ └── 题目名称：签到.mhtml │ └── 题目名称：问卷调查 │ └── 题目名称：问卷调查.mhtml ├── 02Crypto-5题 │ ...
Burp-Suite-Certified-Practitioner-Exam-Study
Estudio para el examen Burp Suite Certified Practitioner Estas son mis notas de estudio con más de 110 laboratorios de PortSwigger Academy. Usé estos laboratorios para aprobar el examen de Burp Suite Certified Practitioner en 2023. Mi certificación BSCP. Para más información visita PortSwigger...
IntruderPayloads
IntruderPayloads 入侵载荷 Burpsuite 入侵载荷、BurpBounty 载荷（https://github.com/wagiro/BurpBounty）、模糊测试列表和渗透测试方法论的集合。要拉取所有第三方仓库，请在 IntruderPayloads 文件夹所在目录下运行 install.sh。 作者：[email protected] - https://sn1persecurity.com OWASP 测试检查清单： 爬虫、机器人与爬行器 IG-001 搜索引擎发现/侦察 IG-002 识别应用入口点 IG-003 Web 应用指纹识别测试...