Form Maker < 1.13.60 - Authenticated Stored XSS

The plugin does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Create or edit a form and add the following payload in the Form Title field "autofocus onmouseover=alert/XSS///...

Stripe: HTML Injection in the Invoice memos field

The memo field in customer invoices on Stripe was vulnerable to HTML injection, allowing an attacker to create a login form and steal a victim's login credentials through the auto-save functionality of their browser. This could result in the takeover of a victim's account...

CVE-2020-20391

Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via 1 Add Snippet and 2 Save snippets...

CVE-2020-20391

Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via 1 Add Snippet and 2 Save snippets...

PT-2021-10487

Name of the Vulnerable Software and Affected Versions: GetSimpleCMS version 3.4.0a Description: The issue is related to a Cross Site Scripting vulnerability. It affects the admin/snippets.php file via two specific actions: 1 Add Snippet and 2 Save snippets. Recommendations: For GetSimpleCMS versi...

CVE-2020-20391: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via 1 Add Snippet and 2 Save snippets...

getsimplecms 跨站脚本漏洞

GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A cross-site scripting vulnerability exists in admin/snippets.php in GetSimple CMS version 3.4.0a. An attacker can exploit this vulnerability via Add Snippet and Save snippets to conduct cross-site...

NSClient++ 0.5.2.35 Remote Code Execution Exploit

This Metasploit module allows an attacker with knowledge of the admin password of NSClient++ to start a privileged shell. For this module to work, both web interface of NSClient++ and ExternalScripts feature should be enabled. This module requires Metasploit: https://metasploit.com/download Curre...

CVE-2021-33031

In LabCup before v2next18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email...

CVE-2021-34546

An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to...

CVE-2021-33031

In LabCup before v2next18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email...

Authentication flaw

In LabCup before v2next18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email...

CVE-2021-34546

An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to...

CVE-2021-34546: Improper Authentication

An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to...

PT-2021-20540

Name of the Vulnerable Software and Affected Versions: NetSetMan Pro versions prior to 5.0 Description: An unauthenticated attacker with physical access to a computer, where the pre-logon profile switch button within the Windows logon screen is enabled, can drop to an administrative shell and...

LabCup 授权问题漏洞

LabCup is a laboratory and research organization software management system from LabCup Ireland. It helps academic researchers and safety officers with chemical inventory management, risk assessment and compliance. An authorization issue vulnerability exists in LabCup, which arises from the abili...

PT-2021-20023

Name of the Vulnerable Software and Affected Versions LabCup versions prior to 6.3.0.03 Description The issue allows unauthorized actions to be performed by users without access to user management, potentially leading to account takeover. An attacker can change another user's email address if the...

SUSE: Security Advisory (SUSE-SU-2018:2037-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-24333

The CVE-2021-24333 case involves the Content Copy Protection & Prevent Image Save WordPress plugin (

CVE-2021-24333: Cross-Site Request Forgery (CSRF)

The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them...