Cross site scripting

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting XSS via /admin/users/save.php...

GHSA-46X4-9JMV-JC8P Django Access Restrictions Bypass

Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...

Django Access Restrictions Bypass

Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...

WBCE CMS 跨站脚本漏洞

WBCE CMS is an open source content management system CMS based on PHP and MySQL. version 1.5.2 of WBCE CMS contains a cross-site scripting vulnerability that can be exploited by attackers to conduct cross-site scripting XSS attacks via /admin/users/save.php...

WBCE CMS 跨站脚本漏洞

WBCE CMS is an open source content management system CMS based on PHP and MySQL. version 1.5.2 of WBCE CMS contains a cross-site scripting vulnerability that can be exploited to cause a cross-site scripting XSS attack via the \admin\pages\sectionssave.php namesection2 parameter...

Showdoc CSRF Vulnerability

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

Craft CMS Cross-site Scripting (XSS) Vulnerability

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

GHSA-72PF-CVWQ-VGQG Craft CMS Cross-site Scripting (XSS) Vulnerability

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

Moodle Authentication Bypass in Question-Bank

The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a savequestion action...

GHSA-3RQJ-JCHW-9CC7 Moodle Authentication Bypass in Question-Bank

The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a savequestion action...

save-ibiza.com Cross Site Scripting vulnerability OBB-2615328

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-19920

Name of the Vulnerable Software and Affected Versions USU Oracle Optimization versions prior to 5.17 Description The issue allows authenticated quantum users to achieve remote code execution due to Java deserialization in the "/v2/quantum/save-data-upload-big-file" API endpoint. This is...

CVE-2022-29936: Deserialization of Untrusted Data

USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product...

CVE-2022-27340

MCMS v5.2.7 contains a Cross-Site Request Forgery CSRF via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data...

CVE-2022-29020

ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...

PT-2022-19368

Name of the Vulnerable Software and Affected Versions ForestBlog through 2022-02-16 Description The issue allows for XSS during the addition of a user avatar. This occurs in the admin/profile/save endpoint, specifically with the userAvatar parameter. The estimated number of potentially affected...

CVE-2022-29020: Improper Neutralization of Input During Web Page Generation

ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar...

Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Popup Maker Create Popup Popup Settings Triggers Add New Cookie Add Cookie...

CVE-2022-27291

D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup. This vulnerability allows attackers to cause a Denial of Service DoS via the config.savenetworkenabled parameter...

CVE-2022-27291

D-Link DIR-619 Ax v1.00 was discovered to contain a stack overflow in the function formdumpeasysetup. This vulnerability allows attackers to cause a Denial of Service DoS via the config.savenetworkenabled parameter...