121 matches found
CVE-2025-5696
Affects Brilliance Golden Link Secondary System up to 20250424. The vulnerability stems from manipulating the clientname parameter in /storagework/rentChangeCheckInfoPage.htm, enabling SQL injection. Exploitation is remote; multiple sources confirm public disclosure and potential use. Impact is S...
CVE-2024-36819
MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...
CVE-2023-24233
A stored cross-site scripting XSS vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Client Name parameter...
USN-7394-1 ruby-doorkeeper vulnerabilities
Jonathan Clem and Justin Bull discovered that Doorkeeper could allow arbitrary token revocation and replay attacks. An attacker could possibly use this issue to gain unauthorized access to a system. CVE-2016-6582 It was discovered that Doorkeeper incorrectly handled storing client names. An...
DRUPAL-CONTRIB-2025-013
This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources. The module does not use Cross Site Request Forgery CSRF tokens to protect routes for enabling a client. This vulnerability is mitigated by the fact that an...
ASUS RT-N12+ Router Arbitrary Command Execution
The vulnerability of ASUS RT-N12+ B1 router’s microprogramming software is related to the lack of measures taken to protect data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands through CSV injection using the client name parameter...
CVE-2024-36819
MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...
CVE-2024-36819
MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...
MAPOS Security Vulnerability
MAPOS is a service order control system from the individual developer Ramon Silva. A security vulnerability exists in MAPOS prior to version 4.45.0, which stems from a cross-site scripting vulnerability in the Client Name parameter...
CVE-2024-36819
MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...
CVE-2024-36819
MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...
PT-2024-27168 · Mapos · Mapos
Name of the Vulnerable Software and Affected Versions: MAP-OS versions 4.45.0 and earlier Description: The issue allows malicious users to insert a malicious payload into the Client Name input, resulting in unauthorized script execution on the administrator and employee dashboards when a service...
CVE-2024-36819: Improper Neutralization of Input During Web Page Generation
MAP-OS 4.45.0 and earlier is vulnerable to Cross-Site Scripting XSS. This vulnerability allows malicious users to insert a malicious payload into the "Client Name" input. When a service order from this client is created, the malicious payload is displayed on the administrator and employee...
CVE-2024-28328
CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format...
CVE-2024-28328
CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format...
CVE-2024-28328
The Asus RT-N12+ B1 router is vulnerable to CSV Injection due to a lack of data sanitization at the control level regarding the client name parameter. An administrator user can inject arbitrary commands or formulas which may be triggered and executed in a different user session when the data is e...
CVE-2024-28328: Improper Neutralization of Special Elements used in a Command
CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client name parameter which can be triggered and executed in a different user session upon exporting to CSV format...
ASUS RT-N12 安全漏洞
ASUS RT-N12 is a router from Asus China. A security vulnerability exists in ASUS RT-N12+ B1, which stems from the presence of a CSV injection vulnerability that allows an administrator user to inject arbitrary commands or formulas into the client name parameter...
PT-2024-4605 · Asus · Asus Rt-N12+ B1
Name of the Vulnerable Software and Affected Versions: ASUS RT-N12+ B1 version affected versions not specified Description: The issue is related to a lack of data sanitization on the administrative level, allowing for the exploitation of a CSV injection vulnerability. This vulnerability enables a...