CVE-2023-36995: Improper Neutralization of Input During Web Page Generation

TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie...

CVE-2023-36995

CVE-2023-36995 affects TravianZ versions 8.3.4 and earlier. The vulnerability is a cross-site scripting (XSS) issue via multiple endpoints: Alliance tag/name, statistics page, link preferences, Admin Logs, and the COOKUSR cookie. Connected documents do not specify a remediation version or patch; ...

CVE-2023-36995

TravianZ through 8.3.4 allows XSS via the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie...

Lark Technologies: Improper Access Control allows OTP bypass

A vulnerability was discovered that allowed the one-time password requirement to be bypassed when directly accessing the admin log download endpoint. This could have enabled users within the organization to access admin logs without verifying their identity. The issue was resolved after being...

CVE-2022-0230

The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins...

CVE-2021-25078

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests...

CVE-2021-24756

The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting attacks against admins viewing the logs...

WordPress 插件跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin. The WordPress plugin 404 to 301 â€" Redirect, Log and Noti...

CVE-2020-21127

MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel...

Sql injection

MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel...

CVE-2020-21127

MetInfo 7.0.0 is affected by a SQL injection vulnerability exposed at admin/?n=logs&c=index&a=dodel. Multiple sources (NVD CVE-2020-21127; Red Hat advisory; CVE databases) confirm the issue, with CVSS v3.1 metrics showing a base score of 9.8 (CRITICAL) and CVSS v2.0 of 7.5 (HIGH). No exploit code...

Metinfo MetInfo SQL注入漏洞

MetInfo using PHP + Mysql architecture, is a very SEO-friendly, full-featured, support for multi-language, responsive display, extremely suitable for business, corporate website construction cms station-building system. MetInfo 7.0.0 version of the existence of SQL injection vulnerability,...

CVE-2020-20981

A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information...

CVE-2020-20585

A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information...

CVE-2020-22790

Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web script or HTML via modifying the name of the users. The XSS is executed when an administrator access the logs...

CVE-2021-21494

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logsajax.php tipo parameter. An attacker can leverage this to read the centralmka2 session token cookie, which is not set to HTTPOnly...

CVE-2021-21494

MK-AUTH through 19.01 K4.9 allows XSS via the admin/logsajax.php tipo parameter. An attacker can leverage this to read the centralmka2 session token cookie, which is not set to HTTPOnly...

Sentrifugo cross-site scripting vulnerability (CNVD-2021-01545)

Sentrifugo is a human resource management system. The system includes functions for human resources management, performance appraisal, recruitment management and asset management. A cross-site scripting vulnerability exists in Sentrifugo version 3.2, which originates from inserting an x-forward-f...

CVE-2020-28365

Sentrifugo 3.2 allows Stored Cross-Site Scripting XSS vulnerability by inserting a payload within the X-Forwarded-For HTTP header during the login process. When an administrator looks at logs, the payload is executed. NOTE: This vulnerability only affects products that are no longer supported by...

PT-2020-16997 · Sentrifugo · Sentrifugo

Name of the Vulnerable Software and Affected Versions: Sentrifugo version 3.2 Description: The issue allows for Stored Cross-Site Scripting XSS by inserting a payload within the X-Forwarded-For HTTP header during the login process. When an administrator views logs, the payload is executed. This...