CVE-2024-52701

A stored cross-site scripting XSS vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter...

CVE-2024-52701

CVE-2024-52701 is a stored XSS in Piwigo v14.5.0 (Configuration page) where a crafted payload inserted into the Page banner parameter can execute arbitrary scripts/HTML in a victim’s browser. Affected software: Piwigo 14.5.0; impact is browser-based script execution with low integrity/confidentia...

CVE-2024-52701

A stored cross-site scripting XSS vulnerability in the Configuration page of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page banner parameter...

Automatic Systems SlimLane 安全漏洞

Automatic Systems SlimLane is a high-performance electronic inspection system based on a high-density infrared beam matrix from Automatic Systems. Automatic Systems SlimLane has a security vulnerability that originates from the FtpConfig.php page containing a cross-site scripting vulnerability...

CVE-2023-1604

The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configurationpage function. This makes it possible for unauthenticated attackers to add and import redirects, includi...

CVE-2023-1604

The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configurationpage function. This makes it possible for unauthenticated attackers to add and import redirects, includi...

CVE-2023-1604 Short URL <= 1.6.8 - Cross-Site Request Forgery via configuration_page

The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configurationpage function. This makes it possible for unauthenticated attackers to add and import redirects, includi...

CVE-2023-1604

The CVE-2023-1604 entry concerns the WordPress Short URL plugin (versions up to 1.6.8). The underlying issue is missing or incorrect nonce validation in the configuration_page function, which leads to a Cross-Site Request Forgery. As a result, unauthenticated attackers can trick a site administra...

PT-2024-25370 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: A reflected cross-site scripting XSS issue exists in an undisclosed page of the BIG-IP Configuration utility. This allows an attacker to run JavaScript in the context of the currently...

Meta4 HR security breach

Cegid Meta4 HR is a human resource management software HRM platform from Cegid Corporation. A security vulnerability exists in Meta4 HR version 819.001.022 and prior versions, which stems from a configuration page being placed on an Internet-facing web server, resulting in a file path being expos...

BIT-GITLAB-2021-22262

Missing access control in all GitLab versions starting from 13.12 before 14.0.9, all versions starting from 14.1 before 14.1.4, and all versions starting from 14.2 before 14.2.2 with Jira Cloud integration enabled allows Jira users without administrative privileges to add and remove Jira Connect...

CVE-2022-23086

Handlers for CFGPAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may...

CVE-2023-26998

Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page...

CVE-2023-26998

Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator parameter of the Alert Configuration page...

NetScout nGeniusONE Cross-Site Scripting Vulnerability

NetScout nGeniusONE is a centralized application management and network performance solution from NetScout, Inc. A cross-site scripting vulnerability exists in NetScoutnGeniusOne version v.6.3.4 that could allow a remote attacker to execute arbitrary code via the creator parameter on the Alert...

CVE-2023-26998

CVE-2023-26998 affects NetScout nGeniusOne 6.3.4. The vulnerability is a Cross Site Scripting issue in the Alert Configuration page, exploitable via the creator parameter, enabling a remote attacker to execute arbitrary code. Root cause relates to unsanitized input in the creator field. No offici...

PT-2024-12119

Name of the Vulnerable Software and Affected Versions NetScoutnGeniusOne version 6.3.4 Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the creator parameter of the "Alert Configuration" page. This enables the attacker to perform unauthorized actions...

CVE-2023-21416

Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-Service attack allowing for an attacker to block access to the overlay configuration page in the web interface of the Axis device. This flaw can only be exploited...

HTML Injection

slurm-wlm is vulnerable to Race Condition. This vulnerability allows an attacker who has access to the plugin's configuration page to inject malicious HTML into the page. This malicious HTML could then be executed by users who visit the configuration page, which could allow the attacker to steal...

CVE-2023-38423

A cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...