CVE-2019-12346 – miniOrange SAML SP Single Sign On WordPress Plugin XSS

miniOrange SAML SP Single Sign On WordPress Plugin versionĀ 4.8.72 and below are vulnerable to a Cross Site Scripting attack via a specially crafted SAMLReponse XML payload.

This exploit works by passing a crafted SAMLReponse and RelayState variable to

It will then parse out the SAMLResponse message and in the event that the SAML is anything other than a “Success” the script will dump the contents of the expected parameter, so you can inject any HTML into this variable.

For example a SAMLResponse payload will look like this:

This payload will need to be Base64 encoded and sent as a “SAMLReponse” parameter along with RelayState=testValidate.

Proof of concept:


CVE-2019-11511 – Zoho ManageEngine ADSelfService Plus XSS

RestAPI/PasswordSelfServiceAPI in Zoho ManageEngine ADSelfService Plus version 5707 and below allows remote attackers to inject arbitrary web
script or HTML via the PSS_OPERATION parameter.

Example Proof of Concept:

Store XSS Payload:

Payload Execution:

Google Dork: