3084 matches found
CVE-2017-0371: Undefined Security Weakness
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attrtitle url;" attack within a DIV element that has an attacker-controlled URL in the title attribute...
Discourse 安全漏洞
Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse, which stems from a problem with the software's parsing of URL streams. A denial-of-service attack can be triggered by a user...
CVE-2021-24904
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24904
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
PT-2022-9500
Name of the Vulnerable Software and Affected Versions Mortgage Calculators WP WordPress plugin versions prior to 1.56 Description The issue concerns a lack of sanitization on the color setting of the background of a calculator. This could allow high privilege users to perform Stored Cross-Site...
CVE-2021-24904: Improper Neutralization of Input During Web Page Generation
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
Unauthorized Access Vulnerability in KingFusion Development System of Beijing Asian Control Technology Development Co.
Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise of automation software platform. Beijing Asia Control Technology Development Co., Ltd. KingFusion development system there is an unauthorized access vulnerability, attackers can use the vulnerability to obtain...
CVE-2021-44983: Files or Directories Accessible to External Parties
In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column...
ALBA-2022:0363 gnome-control-center bug fix update
The gnome-control-center package contains configuration utilities for the GNOME desktop, which allow to configure accessibility options, desktop fonts, keyboard and mouse properties, sound setup, desktop theme and background, user interface properties, screen resolution, and other settings. Bug...
CVE-2022-22294
A SQL injection vulnerability exists in ZFAKA=1.43 which an attacker can use to complete SQL injection in the foreground and add a background administrator account...
CVE-2022-22294
A SQL injection vulnerability exists in ZFAKA=1.43 which an attacker can use to complete SQL injection in the foreground and add a background administrator account...
CVE-2021-46087
In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...
Design/Logic Flaw
In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...
CVE-2021-46087
In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...
CVE-2021-46087
In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...
PT-2022-12562
Name of the Vulnerable Software and Affected Versions jfinal cms versions 5.1.0 and later Description The issue is related to a storage XSS vulnerability in the background system of the CMS. This occurs because the developers do not filter the parameters submitted by the user input form, allowing...
CVE-2021-46087: Improper Neutralization of Input During Web Page Generation
In jfinalcms = 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code...
CVE-2021-46028
In mblog = 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted...