5606 matches found
CVE-2021-27288
Cross Site Scripting XSS in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Comment" field in "/profile/activity" page...
CVE-2021-27288
Cross Site Scripting XSS in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Comment" field in "/profile/activity" page...
CVE-2021-21544
Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user...
PT-2021-17384
Name of the Vulnerable Software and Affected Versions X2Engine X2CRM version 7.1 Description The issue allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the Comment field in the "/profile/activity" API endpoint. This can lead to the disclosure o...
CVE-2021-27288: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS in X2Engine X2CRM v7.1 allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "Comment" field in "/profile/activity" page...
upload.bcb.gov.br Open Redirect vulnerability OBB-1983676
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| upload.bcb.gov.br ---|--- Open Bug Boun...
VulnCheck KEV: CVE-2019-9881
The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled...
Parsoid comment fostering allows for inserting mostly arbitrary <meta> tags
More info at https://phabricator.wikimedia.org/T279451...
Privilege Escalation
projen is vulnerable to privilege escalation. The vulnerability exists due to workflow being able to be triggered the issuecomment on the pull request...
Design/Logic Flaw
projen is a project generation tool that synthesizes project configuration files such as package.json, tsconfig.json, .gitignore, GitHub Workflows, eslint, jest, and more, from a well-typed definition written in JavaScript. Users of projen's NodeProject project type including any project type...
Open redirect
There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago...
php:php-fuzz-exif: Heap-buffer-overflow in _estrdup
Detailed Report: https://oss-fuzz.com/testcase?key=5558318815903744 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-exif Job Type: aflasanphp Platform Id: linux Crash Type: Heap-buffer-overflow READ 13 Crash Address: 0x6040000c1c78 Crash State: estrdup exifprocessusercomment...
Cross site scripting
remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: LocatorURL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go...
CVE-2021-29271
remark42 before 1.6.1 allows XSS, as demonstrated by "Locator: LocatorURL:" followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go...
ceskatelevize.cz Cross Site Scripting vulnerability OBB-1967838
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| ceskatelevize.cz ---|--- Open Bug Bount...
CVE-2021-27315
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter...
CVE-2021-27315
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter...
CVE-2021-27315
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter...
PT-2021-17391
Name of the Vulnerable Software and Affected Versions Doctor Appointment System version 1.0 Description The issue is related to a blind SQL injection in the contactus.php file. An unauthenticated attacker can insert malicious SQL queries via the comment parameter. Recommendations For Doctor...
CVE-2021-27315: Improper Neutralization of Special Elements used in an SQL Command
Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter...