CVE-2024-54997: Improper Control of Generation of Code

MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit...

CVE-2024-54996: Improper Neutralization of Input During Web Page Generation

MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create...

CVE-2024-54994

MonicaHQ v4.1.2 is affected by multiple Client-Side Injection vulnerabilities located in the Add a new relationship feature. The root cause is the improper neutralization of input via the first_name and last_name parameters. Impacting the client-side environment, these vulnerabilities could allow...

CVE-2024-54994

MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the firstname and lastname parameters in the Add a new relationship feature...

CVE-2024-54994: Improper Neutralization of Input During Web Page Generation

MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the firstname and lastname parameters in the Add a new relationship feature...

PT-2025-3087

Name of the Vulnerable Software and Affected Versions MonicaHQ version 4.1.1 Description The issue is related to an authenticated Client-Side Injection vulnerability. This vulnerability can be triggered by an authenticated user through the entry text field at the "/journal/entries/ID/edit" API...

CVE-2024-54996

MonicaHQ v4.1.2 was discovered to contain multiple authenticated Client-Side Injection vulnerabilities via the title and description parameters at /people/ID/reminders/create...

CVE-2024-54998

MonicaHQ v4.1.2 was discovered to contain an authenticated Client-Side Injection vulnerability via the Reason parameter at /people/h:id/debts/create...

CVE-2024-54996

MonicaHQ v4.1.2 is susceptible to multiple authenticated Client-Side Injection vulnerabilities. The root cause is the improper neutralization of input within the title and description parameters at the /people/ID/reminders/create API endpoint. An authenticated user can exploit these parameters to...

CVE-2024-54997

MonicaHQ v4.1.1 was discovered to contain an authenticated Client-Side Injection vulnerability via the entry text field at /journal/entries/ID/edit...

CVE-2024-54994

MonicaHQ v4.1.2 was discovered to contain multiple Client-Side Injection vulnerabilities via the firstname and lastname parameters in the Add a new relationship feature...

MonicaHQ 安全漏洞

MonicaHQ is a relationship management system from MonicaHQ, Inc. A security vulnerability exists in MonicaHQ version v4.1.2 that stems from the Reason parameter containing authenticated client-side injection...

CVE-2024-4174

Cross-Site Scripting XSS vulnerability in Hyperion Web Server affecting version 2.0.15. This vulnerability could allow an attacker to execute malicious Javascript code on the client by injecting that code into the URL...

CVE-2024-4174 Cross-Site Scripting (XSS) vulnerability in Hyperion Web Server

Cross-Site Scripting XSS vulnerability in Hyperion Web Server affecting version 2.0.15. This vulnerability could allow an attacker to execute malicious Javascript code on the client by injecting that code into the URL...

SESAMI planfocus CPTO Cross-Site Scripting Vulnerability

SESAMI is an open framework for modern cash optimization. A cross-site scripting vulnerability exists in SESAMI planfocus CPTO version 6.3.8.6, which originates when inserting JavaScript into the Name field on the client side...

CVE-2022-27665

Reflected XSS via AngularJS sandbox escape expressions exists in Progress Ipswitch WSFTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add fold...

10.30.npm-learning (>=1.0.0, <=1.1.0), 2017_node (1.0.0) +3306 more potentially affected by CVE-2023-26116 via angular (>=1.0.8, <=1.8.3)

angular NPM version =1.0.8, =1.0.0, =4.13.7-rc4, =1.103.1, =1.103.1, =1.102.4, =1.102.3, =1.102.3, =1.4.156, =1.0.3, =1.0.0, =1.0.0, =0.5.0, =0.5.2 and more Source cves: CVE-2023-26116 Source advisory: OSV:GHSA-2VRF-HF26-JRP5...

Bottelet Daybyday Crm 跨站脚本漏洞

Bottelet Daybyday Crm is a builder system for task, time, employee, and vacation management by Bottelet Individual Developers. Bottelet DayByDay CRM suffers from a cross-site scripting vulnerability that stems from an application-wide Client-Side Template Injection CSTI suffered in DayByDay CRM,...

Bagisto 1.3.3 - Client-Side Template Injection

Exploit Title: Bagisto 1.3.3 - Client-Side Template Injection Date: 11-25-2021 Exploit Author: Mohamed Abdellatif Jaber Vendor Homepage: https://bagisto.com/en/ Software Link: https://github.com/bagisto/bagisto Version: v1.3.3 Tested on: windows | chrome | firefox Exploit :. 1- register an accoun...

Code Injection in collectiveaccess/providence

Description client side injection Proof of Concept open the https://demo.collectiveaccess.org/find/QuickSearch/Index click on search input the code in search bar clickme https://i.ibb.co/tmB0K64/client.png Impact This vulnerability is injecting malicious code into application...