356 matches found
CVE-2019-15238: Cross-Site Request Forgery (CSRF)
The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field...
TapinRadio 2.11.6 - Address Denial of Service (PoC)
TapinRadio 2.11.6 - Address Denial of Service PoC Exploit Title: TapinRadio 2.11.6 - 'Address' Denial of Service PoC Discovery by: Victor Mondragón Discovery Date: 2019-05-21 Vendor Homepage: http://www.raimersoft.com/ Software Link: www.raimersoft.com/downloads/tapinradiosetupx64.exe Tested...
CVE-2019-3702: Improper Neutralization of Special Elements used in an OS Command
A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LSRM33.7.0 2421 allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request...
CVE-2019-10107
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences - My Account" section...
CVE-2019-10107: Improper Neutralization of Input During Web Page Generation
CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences - My Account" section...
CVE-2018-19081
An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetDNS method allows remote attackers to execute arbitrary OS commands via the IPv4Address field...
Pagekit Bixie Portfolio plugin cross-site scripting vulnerability
Pagekit is a modular, lightweight CMS Content Management System.Bixie Portfolio plugin is used in one of the portfolio plugins. A cross-site scripting vulnerability exists in version 1.2.0 of the Pagekit Bixie Portfolio plugin. A remote attacker can exploit this vulnerability to inject arbitrary...
Alliance of American Football : Stored xss in address field in billing activity at https://shop.aaf.com/Order/step1/index.cfm
Dear Team, Summary: add summary of the vulnerability After looking into https://shop.aaf.com/Order/step1/index.cfm i get to know that there is address field is vulnerable to stored xss which can lead to steal any user's cookie and can lead to complete account takeover Description: add more detail...
PHP Scripts Mall hotel-booking-script Denial of Service Vulnerability
PHP Scripts Mall hotel-booking-script is a hotel booking system script by PHP Scripts Mall India, which includes features like advanced CMS management, review management and booking management. A denial of service vulnerability exists in PHP Scripts Mall hotel-booking-script version 2.0.4, which...
CVE-2018-15191
PHP Scripts Mall hotel-booking-script 2.0.4 allows remote attackers to cause a denial of service via crafted JavaScript code in the First Name, Last Name, or Address field...
CVE-2018-15190
PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field...
CVE-2018-15190: Improper Neutralization of Input During Web Page Generation
PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name, Last Name, or Address field...
PHP Scripts Mall PHP Template Store Script Cross-Site Scripting Vulnerability
PHP Scripts Mall PHP Template Store Script is a set of scripts for selling website templates online by PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall PHP Template Store Script version 3.0.6. The vulnerability can be exploited by a remote attacker to inject...
Cross site scripting
Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified vectors...
CVE-2018-0559
Cross-site scripting vulnerability in Cybozu Mailwise 5.0.0 to 5.4.1 allows remote attackers to inject arbitrary web script or HTML 'Address' via unspecified vectors...
CVE-2017-6199
A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field...
Authentication flaw
A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field...
CVE-2017-6199: Improper Authentication
A remote attacker could bypass the Sandstorm organization restriction before build 0.203 via a comma in an email-address field...
