697 matches found
CVE-2023-51281
CVE-2023-51281 affects the Customer Support System v1.0. The vulnerability is a Cross-Site Scripting (XSS) flaw that allows a remote attacker to escalate privileges via crafted inputs for fields such as firstname, lastname, middlename, contact, and address. Affected component details and exact ro...
CVE-2023-51281
Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firstname, "lastname", "middlename", "contact" and address parameters...
CVE-2023-51281
Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firstname, "lastname", "middlename", "contact" and address parameters...
BIT-LUA-2021-43519
Stack overflow in luaresume of ldo.c in Lua Interpreter 5.1.05.4.4 allows attackers to perform a Denial of Service via a crafted script file...
BIT-LIMESURVEY-2023-44796
Cross Site Scripting XSS vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the generaloptionspanel.php component...
CVE-2024-25167
CVE-2024-25167 affects the eblog v1.0 project. A cross-site scripting (XSS) flaw exists in the description parameter of the comment submission endpoint, allowing a remote attacker to execute arbitrary code. Affected component: the comment submission path handling the description field. Impact: ar...
CVE-2024-26476
An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereqform.php component...
Design/Logic Flaw
An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereqform.php component...
CVE-2024-26476
An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereqform.php component...
CVE-2024-26476
An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereqform.php component...
CVE-2024-26476
OpenEMR prior to 7.0.2 is affected by CVE-2024-26476. A remote attacker can escalate privileges by sending a crafted script to the formid parameter in ereq_form.php. The Red Hat and OSV entries confirm the same issue in OpenEMR’s ereq_form.php formid handling, implying a privilege escalation vuln...
CVE-2024-22917
SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a crafted script...
CVE-2024-24402
An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component...
CVE-2024-24402
An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component...
CVE-2024-24402
An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component...
The vulnerability of the bhyveload utility in FreeBSD operating systems allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the bhyveload module in FreeBSD is related to an incorrect limitation on the path name to the host-path directory with restricted access. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to protected information by loading a specially crafted...
Cross site scripting
Cross Site Scripting XSS vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files...
Code injection
An issue in idocv v.14.1.320231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script...
Directory traversal
Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...