MantisBT Cross-Site Scripting Vulnerability (CNVD-2017-04629)

MantisBT is an open-source issue management system developed in PHP and commonly used for internal collaboration within corporate teams. A cross-site scripting vulnerability exists in the admconfigreport.php page in MantisBT 1.2.16 and later versions, which can be exploited to inject script or HT...

CVE-2017-6973

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...

CVE-2017-7250

A Cross-Site Scripting XSS was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data action passed to the 'Gazelle-master/sections/tools/finances/bitcoinbalance.php' URL. An attacker could execute arbitrary HTML and script code in a...

PT-2017-17124 · Andrzuk · Finecms

Name of the Vulnerable Software and Affected Versions: andrzuk/FineCMS versions prior to 2017-03-06 Description: The issue is related to a reflected XSS in index.php due to missing validation of the action parameter in application/classes/application.php. Recommendations: For versions prior to...

phpFileManager cmd Parameter Command Execution

A remote command execution vulnerability exists in phpFileManager. The vulnerability is due to a design weakness when handling HTTP requests with "action" parameter set to 6 or 9. A remote user can exploit this vulnerability by injecting arbitrary command in the "cmd" parameter...

CVE-2015-5151

Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2014-7290

Multiple cross-site scripting XSS vulnerabilities in Atlas Systems Aeon 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 Action or 2 Form parameter to aeon.dll...

CVE-2014-3712

Katello allows remote attackers to cause a denial of service memory consumption via the 1 mode parameter in the setuputils function in contentsearchcontroller.rb or 2 action parameter in the respond function in api/apicontroller.rb in app/controllers/katello/, which is passed to the tosym method...

Cross site scripting

Cross-site scripting XSS vulnerability in client-assist.php in the dsSearchAgent: WordPress Edition plugin 1.0-beta10 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2014-4521

Cross-site scripting XSS vulnerability in client-assist.php in the dsIDXpress IDX plugin before 2.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

BulletScript MailList bsml.pl Information Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9311/info It has been reported that BulletScript MailList may be prone to an information disclosure vulnerability that may allow remote attackers to gain access to sensitive information. The issue is reported to be presen...

Yblog uss.php action Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/20280/info Yblog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage these issues to have arbitrary script code execute in...

PYSEC-2014-16

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

Cross site scripting

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

PYSEC-2014-16

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

CVE-2012-6131

Cross-site scripting XSS vulnerability in cgi/client.py in Roundup before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the @action parameter to support/issue1...

CVE-2014-2092

Cross-site scripting XSS vulnerability in lib/filemanager/ImageManager/editorFrame.php in CMS Made Simple 1.11.10 allows remote attackers to inject arbitrary web script or HTML via the action parameter, a different issue than CVE-2014-0334. NOTE: the original disclosure also reported issues that...

Apache Struts 2 'action:' Parameter Prefix Security Constraint Bypass

The remote web application appears to use Struts 2, a web framework used for creating Java web applications. The version of Struts 2 in use is affected by a security constraint bypass vulnerability due to a flaw in the action mapping mechanism. Under certain unspecified conditions, an attacker...