1736 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...
CVE-2018-12094
Dimofinf CMS 3.0.0 is affected by a reflected Cross‑Site Scripting (XSS) vulnerability in news.php, exploitable via the id parameter in GET requests. Public disclosures and exploits indicate remote attackers can inject arbitrary script/HTML, with PoCs targeting the id parameter (e.g., news.php?id...
CVE-2018-12094
Cross-site scripting XSS vulnerability in news.php in Dimofinf CMS Version 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...
CVE-2018-1496
IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...
Design/Logic Flaw
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length...
CVE-2015-9238
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length...
CVE-2014-10067
paypal-ipn before 3.0.0 uses the testipn parameter which is set by the PayPal IPN simulator to determine if it should use the production PayPal site or the sandbox. With a bit of time, an attacker could craft a request using the simulator that would fool any application which does not explicitly...
Wordpress Plugin Booking Calendar 3.0.0 - SQL Injection Cross-Site Scripting
Wordpress Plugin Booking Calendar 3.0.0 - SQL Injection Cross-Site Scripting Exploit Title: Wordpress Plugin Booking Calendar 3.0.0 - SQL Injection / Cross-Site Scripting Dork: N/A Date: 26.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor: Wachipi Vendor Homepage:...
CVE-2018-10422
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field...
Cross site scripting
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field...
CVE-2018-10422
An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field...
CVE-2018-10422
CVE-2018-10422 : Multiple connected sources confirm a Stored Cross-Site Scripting vulnerability in HongCMS 3.0.0, specifically in the post news feature via the content field. The root cause is a lack of input sanitization/escaping in content handling, allowing arbitrary script/html injection. Aff...
CVE-2018-0549
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.0 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2018-0551
Cross-site scripting vulnerability in Cybozu Garoon 3.0.0 to 4.6.1 allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...
Cybozu Garoon Operation Limit Bypass Vulnerability
Cybozu Garoon is an office software with Chinese, Japanese, and English languages. An operation restriction bypass vulnerability exists in "Folder Settings" in Cybozu Garoon 3.0.0 through 4.2.6. The vulnerability can be exploited by a user with administrative privileges for one or more folders to...
Cybozu Garoon Operational Limit Bypass Vulnerability (CNVD-2018-08811)
Cybozu Garoon is an office software with Chinese, Japanese, and English languages. An operation restriction bypass vulnerability exists in the session authentication settings in Cybozu Garoon 3.0.0 through 4.2.6. The vulnerability can be exploited by users logging in to the product with...
Apache OpenMeetings Denial of Service Vulnerability (CNVD-2018-06545)
Apache OpenMeetings is the United States Apache Apache Software Foundation developed a set of multi-language customizable video conferencing and collaboration system, which supports audio, video and allows users to view each participant's desktop and so on. A security vulnerability exists in Apac...
Smart Shoutbox, 2.9.5, SQL Injection
Smart Shoutbox by thekrotek.com, version 2.9.5 and previous, SQL Injection resolution: update to 3.0.0, version released July 2017 update notice: so far the developer has not made an update notice making clear that this was a security release The developer says "Version 3.0 is an absolutely new...
CVE-2018-0121
A vulnerability in the authentication functionality of the web-based service portal of Cisco Elastic Services Controller Software could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrator privileges on an affected system. The...