219 matches found
Judging Management System v1.0 - Remote Code Execution (RCE)
Exploit Title: Judging Management System v1.0 - Remote Code Execution RCE Date: 12/11/2022 Exploit Author: Angelo Pio Amirante Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15910/judging-management-system-using-php-and-mysql-free-source-code.ht...
UBUNTU-CVE-2022-45436
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting XSS. As a manager privilege user , create a network map containing name as xss payload. Once created, admin user must clic...
CVE-2022-45436
Pandora FMS/Artica PFMS v765 is affected by a vulnerability described as improper neutralization of input during web page generation (XSS) in the network maps editor. A manager-privilege attacker can create a network map whose name contains an XSS payload; when an admin user later edits network m...
CVE-2022-43980
There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS...
Stored Cross Site Scripting (Network Maps Editor functionality)
Description Hello Team, Hope you are doing well. I have found a stored cross-site scripting vulnerability in the network maps edit functionality. What is stored cross site scripting attack? Stored XSS, occurs when user supplied input is stored and then rendered within a web page. Typical entry...
CVE-2022-32176
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3b are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the "Compress Upload" functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the...
PT-2022-21139 · Unknown · Gin-Vue-Admin
Name of the Vulnerable Software and Affected Versions: Gin-Vue-Admin versions v2.5.1 through v2.5.3b Description: The issue allows for Unrestricted File Upload, leading to the execution of javascript code through the "Compress Upload" functionality to the Media Library. When an admin user views t...
Unrestricted file upload
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the...
CVE-2022-32177 Gin-vue-admin - Unrestricted File Upload
In "Gin-Vue-Admin", versions v2.5.1 through v2.5.3beta are vulnerable to Unrestricted File Upload that leads to execution of javascript code, through the 'Normal Upload' functionality to the Media Library. When an admin user views the uploaded file, a low privilege attacker will get access to the...
PT-2022-7403 · Glpi +2 · Glpi +2
Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.3 Description: The issue is related to the improper escaping of information associated with the registration key on the registration key configuration page in GLPI, a Free Asset and IT Management Software package...
PrestaShop Product Comments Cross-site Scripting vulnerability
Impact An attacker could steal an admin's cookie Patches The issue is fixed in 5.0.2 References Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
Doctor’s Appointment System 跨站脚本漏洞
Doctor's Appointment System is a doctor's appointment system by Hashen Udara, an individual developer. A security vulnerability exists in Doctor's Appointment System version 1.0, which stems from its admin panel allowing an attacker to steal a cookie to take over the administrator account...
PT-2022-20213 · Cellinx · Cellinx Camera
Name of the Vulnerable Software and Affected Versions: Cellinx Camera affected versions not specified Description: The issue allows an attacker with web access to elevate privileges from guest to administrative by modifying specific cookie values, including is admin and showConfig, enabling chang...
CVE-2022-30620
On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie values from "isadmin", "showConfig". Administrative Privileges which allows changing various configuration in the camera...
CVE-2022-30017
Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing...
Jenkins 插件跨站脚本漏洞
Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.A cross-site scripting vulnerability exists in Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier versions, which ste...
Jenkins 插件 跨站脚本漏洞
Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Agent Server Parameter Plugin 1.0 and earlier versions have a cross-site scripting vulnerability that stems from n...
CVE-2020-19770
A cross-site scripting XSS vulnerability in the system bulletin component of WUZHI CMS v4.1.0 allows attackers to steal the admin's cookie...
