CVE-2024-9320 SourceCodester Online Timesheet App Add Timesheet Form add-timesheet.php cross site scripting

A vulnerability has been found in SourceCodester Online Timesheet App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /endpoint/add-timesheet.php of the component Add Timesheet Form. The manipulation of the argument day/task leads to cross site scripting. Th...

CVE-2024-9320

SourceCodester Online Timesheet App 1.0 contains a cross-site scripting (XSS) vulnerability in the Add Timesheet Form component, due to manipulation of the day/task parameter in /endpoint/add-timesheet.php. The issue can be triggered remotely; public exploit details are referenced in multiple sou...

Inventory Management System 跨站脚本漏洞

Inventory Management System is an inventory management system for stemword individual developers. A cross-site scripting vulnerability exists in SourceCodester Inventory Management System version 1.0, which stems from a cross-site scripting issue contained in the /app/action/addstaff.php page...

Exploit for Cross-site Scripting in Flatpress

CVE-2024-33209 FlatPress 1.3. is vulnerable to Cross Site Scri...

PT-2024-39195 · WordPress · Simple Ldap Login

Name of the Vulnerable Software and Affected Versions: Simple LDAP Login plugin for WordPress versions up to, and including, 1.6.0 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without proper escaping on the URL. This allows unauthenticated...

PT-2024-39192 · WordPress · Gtm Server Side

Name of the Vulnerable Software and Affected Versions: GTM Server Side plugin for WordPress versions up to, and including, 2.1.19 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows unauthenticate...

WordPress plugin GTM Server Side 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

SourceCodester Online Timesheet App 跨站脚本漏洞

SourceCodester Online Timesheet App is a SourceCodester open source web application built with PHP and MySQL designed to simplify time management and task tracking. A cross-site scripting vulnerability exists in version 1.0 of the SourceCodester Online Timesheet App, which stems from a cross-site...

CVE-2024-46333

An authenticated cross-site scripting XSS vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function...

AZL-50147 CVE-2024-46843 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove SCSI host only if added If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcdasyncscan fails during ufshcdprobehba before adding a SCSI host with scsiaddhost and M...

DEBIAN-CVE-2024-46843

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove SCSI host only if added If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcdasyncscan fails during ufshcdprobehba before adding a SCSI host with scsiaddhost and M...

UBUNTU-CVE-2024-46843

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove SCSI host only if added If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcdasyncscan fails during ufshcdprobehba before adding a SCSI host with scsiaddhost and M...

PT-2024-31963 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 14.5.0 Description: The issue is an authenticated cross-site scripting XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML. This is achieved by injecting a crafted payload into the Album Name...

CVE-2024-46333

An authenticated cross-site scripting XSS vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function...

CVE-2024-45984

A Cross Site Scripting XSS vulnerability in adddonor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject malicious scripts that will be executed when the Donor List is viewed...

PT-2024-39290 · WordPress · Store Hours For Woocommerce

Name of the Vulnerable Software and Affected Versions: Store Hours for WooCommerce plugin for WordPress versions up to, and including, 4.3.20 Description: The issue arises from the use of add query arg without proper escaping on the URL, leading to Reflected Cross-Site Scripting. This allows...

CVE-2024-8350

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgmmanagement/v1/adduser/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group...

CVE-2024-7386

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.9.1. This is due to missing nonce validation on the addRefund function. This makes it possible for unauthenticated attackers to perform...

CVE-2024-8350

The CVE entries CVE-2024-8350 and CVE-2024-8349 relate to the Uncanny Groups for LearnDash plugin for WordPress. All versions up to 6.1.0.1 are affected by a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint, allowing authenticated attackers with group leader...

CVE-2024-8350 Uncanny Groups for LearnDash <= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group Add

The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgmmanagement/v1/adduser/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group...