4084 matches found
Denial of Service on embed2 servlet
Description The application stores a 5MB file in a hashmap variable using a user input as a key, with a large number of requests its possible to increase the memory usage of the application and deny the access to embed2.js stencils resource Proof of Concept import requests...
Cross-Site Request Forgery (CSRF) in collectiveaccess/providence
Description More AJAX endpoints vulnerable to CSRF. 1: GET http://10.0.2.15/providence/index.php/find/BrowseObjects/createSetFromResult 2: POST http://10.0.2.15/providence/index.php/find/SearchObjects/saveResultsEditorData Proof of Concept 1:...
in khodakhah/nodcms
Description There is no rate limit sent unlimited email victim or any email address Proof of Concept There is no rate limit return-password , attacker to send unlimited email to victim or any email address. POST /en/return-password HTTP/1.1 Host: demo.nodcms.com User-Agent: Mozilla/5.0 Windows NT...
Open Redirect in fisharebest/webtrees
Description I saw this report : https://huntr.dev/bounties/ad4278af-52b7-4c34-8d43-9b829105d499/ and Also your fix commit https://www.github.com/fisharebest/webtrees/commit/551ad4afbcef2a72a6cf6461f1747762180b12c5 then I should say that the fix can be bypassed with such payloads : If the baseurl ...
Prototype Pollution in liriliri/licia
✍️ Description licia package is vulnerable to Prototype Pollution. The safeSet function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects. 🕵️♂️ Proof of Concept...
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
✍️ Description csrf bug to make clone of a role 🕵️♂️ Proof of Concept i see everywhere csrf token is checking but during cloning of role, it does not check csrf token .\ Belllow url is vulnerable to csrf attack to make a clone of role...
Cross-site Scripting (XSS) - Reflected in slackero/phpwcms
✍️ Description Reflected xss 🕵️♂️ Proof of Concept 'HTTP-REFERER: '.echoempty$ref ? 'unknown' : $ref; 💥 Impact xss bug...
Cross-Site Request Forgery (CSRF) in admidio/admidio
✍️ Description Attacker able to delete any Link with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks it...
Cross-Site Request Forgery (CSRF) in admidio/admidio
✍️ Description Attacker able to unlock/lock any album with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF...
Cross-site Scripting (XSS) - Stored in leantime/leantime
✍️ Description Stored xss bug using a xss payload in the new event title when adding a new event 🕵️♂️ Proof of Concept Goto http://localhost/calendar/addEvent and click on add event and copy paste the following xss payload javascript " Click on safe and see the xss popup with the cookie. 💥 Impact...
Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin
✍️ Description Attacker able to delete any local picture with CSRF attack. It does not matter at all that phproject run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of filebrowser application. It does...
Cross-Site Request Forgery (CSRF) in alanaktion/phproject
✍️ Description Attacker able to delete any issue with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks i...
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
✍️ Description CSRF bug to remove third-party from sales-order 🕵️♂️ Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when removing third-party from sales-order ....
Server-Side Request Forgery (SSRF) in erudika/scoold
✍️ Description Possible SSRF in scoold in user profile picture from URL 🕵️♂️ Proof of Concept Steps to reproduce: 1. Create an account and click on the image. 2. Now open the local server or enter any IP:port ex: http://127.0.0.1:8082 3. Now enter the URL and then view the image, you will see get...
Session Fixation in erudika/scoold
✍️ Description Session Fixation vulnerability found in scoold in which it doesn't expire the sessions after password update. 🕵️♂️ Proof of Concept Steps to reproduce: 1. Open the same account in the normal and private tab. 2. Change the password from anyone tab let's say private and then refresh...
Open Redirect in medialize/uri.js
✍️ Description urijs mishandles certain uses of backslash such as https:/\ and interprets the URI as a relative path. Browsers accept backslashes after the protocol, and treat it as a normal slash, while url-parse sees it as a relative path. 🕵️♂️ Proof of Concept 1. Create the following PoC file:...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager
💥 BUG Stored xss via anonymouse-group 💥 VERSION TESTED latest version as of 4/7/21 💥 IMPACT xss allow to execute arbitary javascript in vicitm account 💥 STEP TO REPRODUCE 1. goto http://localhost/online-rental/app/admin/pageSettings.php and click Preconfigured users and groups tab .\ put bellow...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description There is a Stored XSS on the user profile edit page which occurs due to improper sanitization of the Address field as tested on the latest release. 🕵️♂️ Proof of Concept Step To Reproduce: Go to /invoicesview.php and click add new if you already has any item, just click it to edit...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-rental-property-manager
✍️ Description Stored XSS in adding properties lead by adding owners first name and second name. 🕵️♂️ Proof of Concept Video POC: https://drive.google.com/file/d/1QbdzPJPHmQPsNl-o43a-Slub4Z3hhNh/view?usp=sharing 💥 Impact This vulnerability is capable of Stored XSS...
Improper Privilege Management in bigprof-software/online-invoicing-system
💥 BUG privilege escalation bug to add invoice to a client . 💥 IMPACT unprivileged user can add invoice to a client 💥 STEP TO REPRODUCE 1. From admin account goto http://localhost/online-invoice2/app/admin/pageViewMembers.php and add new user called user-B .\ Now revoke all acccess from client...
in getgrav/grav
✍️ Description A cookie with an overly broad path can be accessed through other applications on the same domain. 🕵️♂️ Proof of Concept Application deployed at http://real.example.com/grav and the application sets a session ID cookie with path "/" when users log in to the forum. then below code is...
Cross-site Scripting (XSS) - Reflected in projectsend/projectsend
✍️ Description GET parameter ?client= in Line 419 of manage-files.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at builtinecho in manage-files.php at line 419. 🕵️♂️ Proof of Concept Data enters a web application...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description Stored xss bug using a xss payload in the full name field, other fields like address, city, state will work as well. 🕵️♂️ Proof of Concept Create a new user with the following payload " in one of the fields i mentioned above; full name, address etc... browse to you're profile and...
Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system
✍️ Description /app/admin/pageEditGroup.php with group-name parameter of pageEditGroup.php is vulnerable to Stored XSS. Line 203 of pageEditGroup.php sends unvalidated data to a web browser, which can result in the browser executing malicious code. In this case the data is sent at builtinecho in...
Open Redirect in causefx/organizr
✍️ Description The file index.php passes unvalidated data to an HTTP redirect function on line 7. Allowing unvalidated input to control the URL used in a redirect can aid phishing attacks. The data is sent at header in index.php at line 7. 🕵️♂️ Proof of Concept The following PHP code instructs the...
OS Command Injection in fabio286/antares
✍️ Description The application displays the connection error message returned by the server without removing the malicious tags, which leads to XSS attacks. https://imgur.com/3MhhvFp.png https://i.imgur.com/RksNgXF.png Being an application made in electron, an XSS can be scaled to RCE, making it...
in lavv17/lftp
✍️ Description Whilst testing lftp built from commit d67fc1 with Clang 13 +ASan on Ubuntu 20.04.2 LTS, we discovered a crafted file which triggers a null pointer dereference and segfault. 🕵️♂️ Proof of Concept echo "aiYgAQEBNA==" | base64 -d /tmp/file.fuzz && ./lftp -f /tmp/file.fuzz The above POC...
in polonel/trudesk
✍️ Description trudesk is vulnerable to arbitrary file upload. The app is allowing upload files, such as text/html. Consequently, It is possible to exploit XSS. 🕵️♂️ Proof of Concept 1. Create a ticket. 2. Access the ticket created and upload an HTML file which contains . 3. Access the HTML file...
Cross-site Scripting (XSS) - Stored in polonel/trudesk
✍️ Description trudesk is vulnerable to XSS via chat. 🕵️♂️ Proof of Concept 1. Send a message with the content . PoC video 💥 Impact JavaScript code execution...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description Reflected XSS in playlists.php when a user asked to add a note in Sequence Entry, resulting in XSS. 🕵️♂️ Proof of Concept https://drive.google.com/file/d/1uU9IxbH3A45V8BSgtFOBrc5Gwj7S7k56/view?usp=sharing 💥 Impact This vulnerability is capable of doing Reflected XSS...
Stack-based Buffer Overflow in falconchristmas/fpp
✍️ Description Hi, there is a stack based buffer overflow in https://github.com/FalconChristmas/fpp/blob/f4a1621c8be15a41305269830b700a2b5443aa0f/src/command.cL131 : When ./fpp is running it can send commands to ./fppd, a daemon that runs a main loop and listen for incoming socket connections : In...
Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp
✍️ Description Hi, few days ago I reported this vulnerability : https://huntr.dev/bounties/8-other-FalconChristmas/fpp/ There were 2 XSS vectors in https://github.com/FalconChristmas/fpp/blob/f032d800a67ed280f8d577d95519a71c95114579/www/runEventScript.phpL41 : php \n"; // 1 // else ? ERROR: Unknow...
OS Command Injection in falconchristmas/fpp
✍️ Description Hi, a command is built without filtering user input in https://github.com/FalconChristmas/fpp/blob/cc026bd238b641ad147a3f8e1df47052e34f16d3/www/copyFilesToRemote.phpL50 php $ip = $GET'ip'; // $command = "rsync -rtDlv --modify-window=1 $compress --stats $fppHome/media/$dir/...
Improper Privilege Management in dolibarr/dolibarr
💥 BUG unprivileged user can attach agenda with leave. 💥 IMPACT user who dont have any access in leave can add agenda to this leave 💥 TESTED VERSION dolibarr 14.0.0-beta 💥 STEP TO REPRODUCE 1. First goto admin account and add user B as normal user .\ Now give user B bellow permission for Agenda...
Improper Privilege Management in dolibarr/dolibarr
💥 BUG unprivileged user can see task associated with a project 💥 IMPACT user dont have access to specific project but still can see task attached to this project . 💥 TESTED VERSION dolibarr 14.0.0-beta 💥 STEP TO REPRODUCE 1. First goto admin account and add user B as normal user .\ Now give user ...
Cross-site Scripting (XSS) - DOM in apexcharts/apexcharts.js
✍️ Description Last version of Apexcharts.js is vulnerable to Cross-Site Scripting XSS 🕵️♂️ Proof of Concept Simply try one of the examples provided in samples/vanilla-js/scatter/scatter-images.html in this way: javascript var options = series: name: 'Messenger', data: 16.4, 5.4, ..... , name:...
Cross-site Scripting (XSS) - Generic in utmsigep/member-directory
✍️ Description Non-administrative functions display success banners after multiple actions that reflect user-input directly without sanitization. 🕵️♂️ Proof of Concept Donation Creation and Update - Donations - New Donation - Enter XSS payloads into the fields Last Name, First Name and Receipt ID,...
in cythron/tweango
✍️ Description The Django secret key was hard coded in the Github repository which is vulnerable as https://huntr.dev/bounties/1-other-cythron/Tweango/ accordingly. Since the GitHub public API monitor every single git commit that is made, attacker can still find the key from commit lists. = It is...
Prototype Pollution in borderlesslabs/assign
Description @borderlesslabs/assign is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC file: // poc.js var a = require"@borderlesslabs/assign" const payload = JSON.parse'"proto":"polluted":"Yes! Its Polluted"'; var obj = console.log"Before : " + .polluted;...
Cross-site Scripting (XSS) - Generic in dolibarr/dolibarr
Description dolibarr is a modern and easy to use web software to manage your business. The error page is vulnerable to self XSS because of lack of escaping on $SERVER'HTTPUSERAGENT' variable before printing it. The flaw is in the dolprinterror function in the htdocs/core/lib/functions.lib.php fil...
Patched get_file tar traversal remains exploitable on supported Python 3.11
Description Keras previously fixed keras.utils.getfile..., extract=True tar archive path traversal in GHSA-hjqc-jx6g-rwp9 / CVE-2025-12060 by routing archive extraction through extractopenarchive and using Python's tarfile.extractallfilter="data" protection for tar files. The remediation is...
Arbitrary File Read via LaTeX Injection in compile_latex_code (potential RCE with shell-escape)
Description The /compile-latex endpoint in backend/routers/discussion/utils.py compilelatexcode function allows any authenticated user to submit arbitrary LaTeX code for server-side compilation. The user-provided LaTeX code is written directly to a .tex file and compiled by the system's LaTeX...
Denial of Service via Uncaught std::filesystem_error in Model Repository Load API (file: parameter NAME_MAX boundary)
This report is not public...
Lack of unique constraint validation allows overwriting evaluators
Description The application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator. Since the backend lacks databa...
High-Severity Command Injection Vulnerability in run_BingBertSquad.sh
This report is not public...
Admin account takeover due to allowed excessive guessing attempts for password reset code
This report is not public...
Denial of service by memory exhaustion
This report is not public...
pickle deserialization vulnerability
Description There is a pickle deserialization vulnerability in the Latex English error correction plug-in function of gptacademic, which allows attackers to achieve remote command execution Environment setup 1. wget https://github.com/binary-husky/gptacademic/archive/refs/tags/version3.83.zip 2...
Stored XSS at Guest Lobby
Description Guest Lobby is vulnerable to XSS when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML Proof of Concept 1.Start a new web conference and change Guest policy to "Ask Moderator" role moderator 2.Attacker edit "Message to the...