ZZCMS 路径遍历漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A path traversal vulnerability exists in ZZCMS version 2023, which stems from the parameter skin in the file /admin/aboutedit.php?action=modify that causes path traversal. No details of the vulnerability are provided at this tim...

GHSA-QGJ8-G9Q4-7F2P gotortc vulnerable to Cross-Site Request Forgery

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to Cross-Site Request Forgery. The /api/config endpoint allows one to modify the existing configuration with user-supplied values. While the API is only allowing localhost to interact without authentication, an...

PT-2024-29384

Name of the Vulnerable Software and Affected Versions dzzoffice version 2.02.1 Description The issue allows for Directory Traversal via the user/space/about.php endpoint. This means an attacker could potentially access files outside the intended directory structure by manipulating the input to th...

CVE-2024-41376

dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php...

PT-2024-38233 · Sourcecodester · Sourcecodester Lot Reservation Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lot Reservation Management System version 1.0 Description: A problematic issue was found in the system, affecting the file "/admin/ajax.php?action=save settings". The manipulation of the about argument leads to cross-site...

SourceCodester Lot Reservation Management System 跨站脚本漏洞

SourceCodester Lot Reservation Management System is a parking lot reservation management system from SourceCodester, Inc. A cross-site scripting vulnerability exists in SourceCodester Lot Reservation Management System version 1.0, which stems from an incorrect manipulation of the about parameter...

Malicious code in sap-about (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 850696bbc92b40c1859364ea39701d4fc1e460527c5e8c0aa5ef6422b36fee99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7786 Malicious code in sap-about (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 850696bbc92b40c1859364ea39701d4fc1e460527c5e8c0aa5ef6422b36fee99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in about-pos (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6329 Malicious code in about-pos (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-36775

Monstra CMS 3.0.4 is affected by an XSS vulnerability in the Edit Profile page, where crafted payloads placed into the About Me field can execute arbitrary web scripts/HTML. The issue stems from reflecting or injecting content via the About Me parameter, enabling potential code execution in the c...

Monstra CMS Security Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS by Sergey Romanenko, an individual developer in Ukraine. A security vulnerability exists in Monstra CMS version v3.0.4. An attacker can exploit the vulnerability to execute arbitrary web script or HTML via a specially crafted...

CVE-2024-36775: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page...

PT-2024-27158 · Unknown · Monstra Cms

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page. This could potentially affe...

Exploit for CVE-2023-5089

Badges !MIT Licensehttps://img.shields.io/badge/Licens...

CVE-2024-3747

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and including, 2.0.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Plugin Blocksy 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-2752: Improper Neutralization of Input During Web Page Generation

The Where Did You Hear About Us Checkout Field for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via order meta in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2024-3747: Improper Input Validation

The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the className parameter in the About Me block in all versions up to, and including, 2.0.39 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2024-27579 · WordPress · Blocksy

Name of the Vulnerable Software and Affected Versions: Blocksy theme for WordPress versions up to, and including, 2.0.39 Description: The issue is related to Stored Cross-Site Scripting via the className parameter in the About Me block due to insufficient input sanitization and output escaping...