dobovo.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-959204 Security Researcher geeknik Helped patch 8834 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting dobovo.com website and its...

Online Appointment - SQL Injection

Online Appointment - SQL Injection Exploit Title: Online Appointment SQL Injection Data: 07.09.2019 Exploit Author: mohammad zaheri Vendor HomagePage: https://github.com/girish03/Online-Appointment-Booking-System Tested on: Windows Google Dork: N/A ========= Vulnerable Page: =========...

smiledirectclub.co.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-958947 Security Researcher geeknik Helped patch 8815 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting smiledirectclub.co.uk websi...

lusk.cz Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-958640 Security Researcher KhanJanny Helped patch 3065 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting lusk.cz website and its...

Reality < 2.4.0 - Multiple Persistent XSS

----- Persistent XSS on any property page: ----- Vulnerable input fields: 1 - Description & Price - 'PRICE POSTFIX TEXT' and 'SECOND PRICE POSTFIX TEXT'; 2 - Additional Information - 'TITLE' and 'VALUE'; 3 - Location & Map - 'ADDRESS '. Payload Sample: ----- Persistent XSS on user profile page:...

Inventory Webapp - 'itemquery' SQL injection

Exploit Title: Inventory Webapp SQL injection Data: 05.09.2019 Exploit Author: mohammad zaheri Vendor HomagePage: https://github.com/edlangley/inventory-webapp Tested on: Windows Google Dork: N/A ========= Vulnerable Page: ========= /php/add-item.php ========== Vulnerable Source: ========== Line3...

Palo Alto Software: Clickjacking

Summary Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of the...

Exploit for Improper Input Validation in Jenkins

hackUtils It is a hack tool kit for pentest and web security research, which is based on BeautifulSoup bs4 module http://www.crummy.com/software/BeautifulSoup/bs4/. Usage: hackUtils.py options Options: -h, --help Show basic help message and exit -b keyword, --baidu=keyword Fetch URLs from Baidu...

XSS Vulnerability in the Mobile Mall of Henan NetZhong.com Computer Science and Technology Co.

Henan net in the net computer technology limited company is a micro letter public platform application and development of science and technology-based technology company. There is an XSS vulnerability in the mobile mall of Henan NetZhong.com Computer Science and Technology Co. Ltd, which can be...

Alkacon OpenCMS 10.5.x - Local File inclusion Vulnerability

Exploit for multiple platform in category web applications Exploit Title: Alkacon OpenCMS 10.5.x - Multiple LFI in Alkacon OpenCms Site Management Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: 10.5.x Tested on: 10.5.5...

Alkacon OpenCMS 10.5.x - Local File inclusion

Exploit Title: Alkacon OpenCMS 10.5.x - Multiple LFI in Alkacon OpenCms Site Management Google Dork: N/A Date: 18/07/2019 Exploit Author: Aetsu Vendor Homepage: http://www.opencms.org Software Link: https://github.com/alkacon/opencms-core Version: 10.5.x Tested on: 10.5.5 / 10.5.4 CVE :...

Weak Password Vulnerability in Tianqing Web Application Security Gateway

SkyQuest Web Application Security Gateway is a new generation of Web security protection and application delivery application security product developed by Qisda, which is used to defend against attacks targeting Web application vulnerabilities, analyze HTTP/HTTPS traffic on Web servers and...

WordPress wp-members plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-members is a website membership plugin used in it. Cross-site request forgery vulnerability exists in WordPress wp-member plugin...

CVE-2019-10383

CVE-2019-10383 is a stored XSS in Jenkins up to 2.191 (LTS up to 2.176.2) where an attacker with Overall/Administer permissions can abuse the update center URL to inject HTML/JavaScript in update center pages. Affected component is Jenkins update center handling; root cause is insufficient escapi...

WordPress posts-in-page plugin path traversal vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. posts-in-page is a plugin for embedding posts in pages. A path traversal vulnerability exists in the WordPress posts-in-page plugin. T...

CVE-2019-15533

XENFCoreSharp (pre-2019-07-16) is affected by CVE-2019-15533: it allows SQL injection in web/verify.php. The connected documents confirm the vulnerable component and input point but do not provide exploit specifics, affected version ranges beyond the date, or remediation details in the supplied s...

WordPress custom-sidebars plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. custom-sidebars is a custom feature list plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

CVE-2019-13599

CVE-2019-13599 affects CentOS Web Panel (CWP) 0.9.8.848, where the login process can be used to determine if a username is valid by comparing response times, creating a user-enumeration timing side-channel. The vulnerability is documented across multiple sources (NVD, Red Hat, CNVD, PRION, etc.) ...

WordPress peters-login-redirect plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. peters-login-redirect is a redirection plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

Kimai 2 - Persistent Cross-Site Scripting

Exploit Title: Kimai 2- persistent cross-site scripting XSS Date: 07/15/2019 Exploit Author: osamaalaa Vendor Homepage: link Software Link: https://github.com/kevinpapst/kimai2 Fixed on Github : https://github.com/kevinpapst/kimai2/pull/962 Version: 2 1-Normal user will try to add timesheet from...