4084 matches found
Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager
✍️ Description Stored XSS in setting up mail sender's name sue to improper sanitization of user input. 🕵️♂️ Proof of Concept Steps to reproduce: 1. Go to http://192.168.43.130:8081/app/admin/pageSettings.php?search-settings=smtp 2. Enter payload " 3. Now visit...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
💥 BUG xss via unpaid-invoice-comment 💥 VERSION TESTED latest version as of 3/7/21 💥 IMPACT xss allow to execute arbitary javascript in vicitm account 💥 STEP TO REPRODUCE 1. goto http://localhost/online-invoice3/app/hooks/calendar-unpaid-invoices.php?date=2021-06-03&view=dayGridMonth and create a...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
💥 BUG xss via invoice-comment 💥 VERSION TESTED latest version as of 3/7/21 💥 IMPACT xss allow to execute arbitary javascript in vicitm account 💥 STEP TO REPRODUCE 1. goto http://localhost/online-invoice3/app/invoicesview.php and create a new invoice .\ During creation put bellow xss payload in...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description stored xss via client comment 🕵️♂️ Proof of Concept 1. First goto http://localhost/online-invoice3/app/clientsview.php and create a new client .\ During creation put bellow xss payload in comment section and save it .\ xss"' 2. Now any user open this client then xss is executed...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
💥 BUG STORED XSSS 💥 TESTED VERSION latest version as of 3/7/21 💥 STEP TO REPRODUCE plz check this 1 minute video to reproduce the bug https://drive.google.com/file/d/16Y2WR7PKj-OpDGGDMAxV60CaiSX2RZXl/view?usp=sharing...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager
✍️ Description Stored xss in adding group name. 🕵️♂️ Proof of Concept Steps to reproduce: 1. Create a group and enter s"' in group name 2. Save and view it you will see popup 💥 Impact This vulnerability is capable of stored xss...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager
✍️ Description Stored xss in profile Full-name field.\ There is a Stored XSS on the user profile edit page which occurs due to improper sanitization of the State name field as tested on the latest release. 🕵️♂️ Proof of Concept Steps to Reproduce: 1. Create a user account. 2. Login into the user...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description There is a Stored XSS on the user profile edit page which occurs due to improper sanitization of the State name field as tested on the latest release. 🕵️♂️ Proof of Concept Steps to Reproduce: 1. Create a user account. 2. Login into the user account. 3. Enter the s"' payload in the...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description There is a Stored XSS on the user profile edit page which occurs due to improper sanitization of the Address field as tested on the latest release. 🕵️♂️ Proof of Concept Steps to Reproduce: 1. Create a user account. 2. Login into the user account. 3. Enter the s"' payload in the...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description GET parameter ?plugin= of plugin.php is vulnerable to reflected cross site scripting. plugin.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at printf in plugin.php 🕵️♂️ Proof of Concept 1. Visit...
Cross-site Scripting (XSS) - Stored in falconchristmas/fpp
✍️ Description GET parameter &value= in fppjson.php is vulnerable to stored cross site scripting. Analysis Trace: 1. Application takes unvalidated user data in &value= from GET request of /fppjson.php?command=setSetting&plugin=&key=emailserver&value=ytes";alert1 2. Now visiting any application pag...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description GET parameter ?plugin= is vulnerable to reflected cross site scripting. Line 17 of pluginconfig.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at printf in pluginconfig.php at line 17. 🕵️♂️ Proof...
Cross-site Scripting (XSS) - Stored in microweber/microweber
✍️ Description Hello, I found CSRF + XSS on website so the impact of XSS could be presented. There is no CSRF token or protection on: http://example.microweber.me/checkout/contact-information-save CSRF HTML PoC: history.pushState'', '', '/' and when we submit request XSS gets executed at the same...
Prototype Pollution in gregberge/xstyled
✍️ Description @xstyled/util is vulnerable to Prototype Pollution. This package allowing for modification of prototype behavior, which may result in Information Disclosure/DoS/RCE. 🕵️♂️ Proof of Concept 1. Create the following PoC file: js // poc.js var util = require"@xstyled/util" var obj =...
Improper Privilege Management in polonel/trudesk
💥 BUG external user can submit ticket even when its disabled 💥 SUMMURY external user can submit ticket even when its disabled 💥 STEP TO REPRODUCE 1. First from admin account goto settings--tickets and disallow Allow public tickets .\ So, external user cant create ticket using url...
in laravel/framework
✍️ Description The activeurl rule for validation in input fails to correctly check dns record with dnsgetrecord resulting in bypassing the validation. 🕵️♂️ Proof of Concept For a laravel installation having the following validation on route: php Route::get'/', function $urlValidator =...
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
✍️ Description The /export/export endpoint does not have CSRF Protection. This could be used to force download account data and potentially spoof users. 🕵️♂️ Proof of Concept - Login to user account. - Create the following file and open the page in browser. // PoC.html To verify that you are a...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description Hi, in https://github.com/FalconChristmas/fpp/blob/39aa11e6f9bf8e7ee63bdbb07ea9fcabf434a60e/www/uploadfile.phpL504 you build a JS script using unsanitized user input, this can lead to XSS : php var activeTabNumber = ; // 🕵️♂️ Proof of Concept Visit...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description Hi, in https://github.com/FalconChristmas/fpp/blob/123cdf2eb11062766da333a7a4d85bc0bf620e47/www/rebootRemoteFPP.phpL15 the variable ip is reflected without prior sanitization : php $ip = $GET'ip'; echo "Rebooting FPP system @ $ip\n"; 🕵️♂️ Proof of Concept Visit :...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description An XSS vulnerability is present in https://github.com/FalconChristmas/fpp/blob/f032d800a67ed280f8d577d95519a71c95114579/www/upgradeOS.phpL26 due to absence of user input sanitization : php Image: 🕵️♂️ Proof of Concept Visit...
Improper Access Control in causefx/organizr
✍️ Description Google Maps API key without proper referer restrictions is found in your repo. It can be embeded to anyone's website and if the billing account is active, it will incur charges on your account. 🕵️♂️ Proof of Concept Visit the following link to verify that you can use the service...
Stack-based Buffer Overflow in codeplea/tinyexpr
✍️ Description Whilst experimenting with repl built from commit 61af1d, with Clang 10 +ASan on Ubuntu 20.04.2 LTS, we discovered an expression containing 4 null characters after a newline which, due to insufficient bounds checking, triggers a stack-buffer-overflow. 🕵️♂️ Proof of Concept echo...
Cross-site Scripting (XSS) - Reflected in tagspaces/viewertext
✍️ Description viewerText used within the Tagspaces to show a preview of text files is vulnerable to cross site scripting. 🕵️♂️ Proof of Concept If any HTML is feeded to setContent function: javascript setContent"alert'xss'; It appends it to the dom without any filteration: javascript...
Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr
💥 BUG Stored xss bypassing xss filter 💥 SUMMURY There are many different user with different role . Here using this xss bug lower level user can make xss attack against higher level user 💥 PAYLOAD XSS15 💥 STEP TO REPRODUCE 1. First goto your account and edit a product . Now put above xss payload ...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description In https://github.com/FalconChristmas/fpp/blob/123cdf2eb11062766da333a7a4d85bc0bf620e47/www/runEventScript.phpL30 you echo unsanitied user input in two places : php \n"; // 1 echo "\n"; system$SUDO . " $fppDir/scripts/eventScript $scriptDirectory/$script $args"; echo "\n"; else ?...
OS Command Injection in falconchristmas/fpp
✍️ Description In https://github.com/FalconChristmas/fpp/blob/123cdf2eb11062766da333a7a4d85bc0bf620e47/www/copystorage.phpL27 you build a command using unsanitized user input : php &1"; // no sanitization : echo "Command: $command\n"; echo...
Path Traversal in thecodingmachine/mouf
✍️ Description Mouf is vulnerable to path traversal attacks on mouf/mouf/src/direct/getsourcefile.php because it doesnt sanitize user supplied parameters as shown below. Vulnerable variable: file Method: GET The $file variable is constructed using the user supplied data, and then a file is open...
Cross-site Scripting (XSS) - Generic in forkcms/library
✍️ Description Please enter a description of the vulnerability. Submitted values weren't escaped in case of date, time or hidden fields. This made it possible to perform an XSS attack by URL tampering 🕵️♂️ Proof of Concept Find a Spoon Form where there is a date, time or hidden field and pass...
Unsafe Deserialization in Public `keras.layers.TorchModuleWrapper.from_config` Reaches `torch.load(weights_only=False)` Without Explicit Unsafe Opt-In
Description keras.layers.TorchModuleWrapper.fromconfig can deserialize attacker-controlled PyTorch pickle data through torch.load..., weightsonly=False when it is called directly through the public Keras layer API. TorchModuleWrapper is exported as a public Keras layer:...
SSRF via Unvalidated URL in Artefact Import and Datastore Scrape (Incomplete CVE-2026-0560 Fix)
Description The fix for CVE-2026-0560 commit 76a54f0 added validateurl SSRF protection to backend/routers/files.py only. Two other endpoints that fetch user-supplied URLs have no SSRF protection and pass attacker-controlled URLs directly to ScrapeMaster: 1. POST...
Path Traversal in DiskIOStore via Unsanitized Layer Names in Keras 3
Description A logic flaw in the Keras 3 v3.0.0+ model saving and loading library handles internal asset paths insecurely. Specifically, the DiskIOStore.make method in keras/src/saving/savinglib.py uses user-provided layer names to construct directory paths without sanitizing for parent directory...
Arbitrary File Read via Log Symlink following in FileTaskHandler
This report is not public...
TFSMLayer bypasses `safe_mode=True`, allowing attacker-controlled code execution during model inference
Summary TFSMLayer allows loading attacker-controlled TensorFlow SavedModels when deserializing a .keras model, even when safemode=True the default. While TensorFlow does not execute SavedModel functions during load, the attacker-controlled graph is registered during deserialization and executes...
Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator
A High severity Unsafe Deserialization vulnerability exists in the airflow.providers.http package. The HttpOperator uses pickle.loads to deserialize untrusted data received from the Triggerer service via the database in the executecomplete method. This allows an attacker who has gained write acce...
Integer Overflow → Heap Buffer Overflow in BYTES-Tensor Parsing (DoS)
This report is not public...
Insecure API Design: Able to Disable 2-Factor Authentication Without OTP or Backup Code
Description There is a minor issue in the 2-Factor Authentication 2FA flow. when a user tries to disable 2FA from the dashboard, the system should ask for a valid OTP or backup code and verify it through the following API: POST /api/auth/2fa/verify HTTP/1.1 Host: 127.0.0.1:3080 User-Agent:...
Possible HTML Injection in Accept-Language header
This report is not public...
User Enumeration via "Account not found" Message
This report is not public...
Brotli decompression bomb DoS
Description urllib3 can not stream brotli-encoded responses properly unlike the way it handles gzip responses. It always loads entire decompressed response body into memory when reading brotli-encoded response, which allows malicious servers to perform DoS attack by responding with decompression...
Divide By Zero lead to DOS
This report is not public...
SQL Injection in DuckDBVectorStore via delete can lead to RCE
Description The delete function in DuckDBVectorStore easily attacks SQL when the attack controls the refdocid parameter.This can help attackers read and write arbitrary files on the server and lead to rce. ddbquery = f""" DELETE FROM self.tablename WHERE jsonextractstringmetadata, '$.refdocid' =...
Stored Cross-Site Scripting (XSS) via SAML IdP XML Injection
An attacker can achieve stored cross-site scripting XSS by injecting malicious JavaScript into the SAML IdP XML metadata. This metadata is used to generate the SAML login redirect URL, which is ultimately set as the value of window.location.href. This vulnerability allows the attacker to execute...
Arbitrary file deletion on Windows via the '/v1/agent/hub/update' endpoint.
This report is not public...
Integer Overflow In /v2/repository/models/<model_name>/load
This report is not public...
IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint Allows Unauthorized Score Updates for Other Users’ Runs
Description An Insecure Direct Object Reference IDOR vulnerability exists in the PATCH /v1/runs/:id/score endpoint. This endpoint allows an attacker to update the score data of any run by manipulating the id parameter in the request URL, which corresponds to the runIdscore in the database. The...
SSRF Vulnerabilities found in Search and Github Integration AutoGPT Blocks
Hi, AutoGPT developers! Summary I have identified several Server-Side Request Forgery SSRF vulnerabilities in the default agent blocks provided by the AutoGPT platform. These vulnerabilities could lead to severe security issues, including credential leakage e.g., GitHub tokens, internal network...
Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes
This report is not public...
Admin user account takeover due to password reset code not being checked on the backend
This report is not public...
Allowing execution user provided regexp, lead to Redos
Description librechat have a functionality of uploading chatgpt chat log. when processing the log, following code is executed: const pattern = new RegExp \u3010$citation.metadata.extra.citedmessageidx\u2020.+?\u3011, 'g', ; const replacement = $citation.metadata.title; messageText =...
Missing access control on endpoint to list all evaluations in lunary-ai/lunary
Description The /v1/evaluators/ route allows users to fetch all evaluators of a project by sending a GET request. However, the route lacks proper access control, such as middleware to ensure that only users with appropriate roles can access evaluator data. The current implementation: Does not...