XXL-JOB Cross-Site Request Forgery Vulnerability

XXL-JOB is a distributed task scheduling platform based on java language from XU Xueli XXL-JOB community. A security vulnerability exists in XXL-JOB version 2.2.0, which originates from a cross-site request forgery CSRF vulnerability in xxl-job-admin/user/add. The vulnerability can be exploited b...

CVE-2023-33750

A stored cross-site scripting XSS vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description parameter at /index.php?s=/article/ApiAdminArticle/itemAdd...

CVE-2023-30788

MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the people/add endpoint and nickName, description, lastName, middleName and firstName parameter...

MonicaHQ 跨站脚本漏洞

MonicaHQ is a people management system from MonicaHQ, Inc. A security vulnerability exists in MonicaHQ version 4.0.0, which can be exploited by remote attackers to execute malicious code in the application via the people/add endpoint and CSTIs in the job and company parameters...

MonicaHQ 跨站脚本漏洞

MonicaHQ is a people management system from MonicaHQ, Inc. A security vulnerability exists in MonicaHQ version 4.0.0, which can be exploited by remote attackers to execute malicious code in the application via the people/add endpoint and CSTIs in the nickName, description, lastName, middleName, a...

CVE-2023-26120

This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update...

CVE-2022-23384

YzmCMS v6.3 is affected by Cross Site Request Forgery CSRF in /admin.add...

OneBlog 跨站脚本漏洞

OneBlog is a simple and beautiful , powerful and adaptive Java blog. The use of springboot development , front-end use Bootstrap. support for mobile adaptive , with a complete front-end and back-end management functions . OneBlog in version 2.2.8 before the existence of XSS vulnerability , the...

OPMS 跨站请求伪造漏洞

OPMS is an OA management system. v1.3 and previous versions of OPMS contain a security vulnerability that can be exploited to add arbitrary user accounts via /user/add...

S-CMS 跨站脚本漏洞

S-CMS is a product developed by Zibo Shining Network Technology Co., Ltd. that provides solutions for building enterprise websites. /app/formadd/ in S-CMS 3.0 has a stored cross-site scripting vulnerability that can be exploited to execute arbitrary Web scripts or HTML via the title entry text bo...

PT-2021-10493 · Unknown · White Shark System

Name of the Vulnerable Software and Affected Versions: White Shark System WSS version 1.3.2 Description: The issue allows remote attackers to exploit the vulnerability and create a task, leading to sensitive information disclosure via the default task add.php endpoint. The default task add.php...

CVE-2021-30176

The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint...

CVE-2021-30176

The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint...

CVE-2021-30176

The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint...

CVE-2021-30176

The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint...

PT-2020-10894 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: NetBox versions 2.6.2 and earlier Description: The issue allows an authenticated user to conduct a cross-site scripting XSS attack against an admin via a GFM-rendered field. This can be demonstrated by the "/dcim/sites/add/" endpoint,...

UWA Cross-Site Request Forgery Vulnerability

UWA is a universal content management system CMS. A cross-site request forgery vulnerability exists in the index.php?g=admin&c=admin&a=addadmindo URL in UWA version 2.3.11. A remote attacker can exploit this vulnerability to perform unauthorized operations...

CVE-2018-19327

An issue was discovered in JTBCPHP 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF...

rejucms cross-site scripting vulnerability (CNVD-2018-19433)

rejucms is an online video web content management system CMS. A cross-site scripting vulnerability exists in rejucms version 2.1, which stems from the program's failure to enforce strict filtering. The vulnerability can be exploited to inject arbitrary web script or HTML by sending the 'uname'...

CVE-2018-11018

An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery CSRF vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html...