5710 matches found
PT-2021-17393
Name of the Vulnerable Software and Affected Versions Doctor Appointment System version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via the comment parameter in the contactus.php file, potentially leading to unauthorized actions on the web application...
CVE-2021-27317: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in contactus.php in Doctor Appointment System 1.0 allows remote attackers to inject arbitrary web script or HTML via the comment parameter...
CVE-2021-27201
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
CVE-2021-27201
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
CVE-2021-27201
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
Design/Logic Flaw
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
CVE-2021-27201
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
PT-2021-17319
Name of the Vulnerable Software and Affected Versions: Endian Firewall Community aka EFW version 3.3.2 Description: The issue allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment. Recommendations: For Endian Firewall Community aka EFW...
CVE-2021-27201: Improper Neutralization of Special Elements used in an OS Command
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
endian_firewall_authenticated_rce
endianfirewallauthenticatedrce CVE-2021-27201 Endinan Fire...
ExpressionEngine: Comment/channel unsubscribe GET CSRF
A vulnerability was identified and fixed that could have allowed attackers to unsubscribe users from comment notifications by exploiting the lack of CSRF protection...
Cross-site Scripting (XSS)
xwiki-commons is vulnerable to cross-site scripting XSS. An attacker can inject arbitrary script via an SVG document to the upload feature of the comment section...
GHSA-43HG-G44Q-474Q Cross Site Scripting (XSS) in XWiki
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
Cross Site Scripting (XSS) in XWiki
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
Design/Logic Flaw
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
CVE-2021-3137 affects XWiki 12.10.2, enabling XSS via an SVG document uploaded to the comment feature. Root cause: insecure handling of SVG uploads leading to script injection. Impact: cross-site scripting in affected deployments. Mitigation: vendor fix (VendorFix) referenced by OpenVAS entries; ...