CVE-2023-44425

D-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this...

CVE-2023-44422

D-Link DIR-X3260 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to exploit this...

D-Link DIR-X3260 安全漏洞

D-Link DIR-X3260 is a Wi-Fi 6 router from China-based D-Link. A security vulnerability exists in the D-Link DIR-X3260 that stems from a remote code execution vulnerability in the SetSysEmailSettings SMTPServerAddress command injection...

D-Link DIR-X3260 安全漏洞

D-Link DIR-X3260 is a Wi-Fi 6 router from China's AUO D-Link. A security vulnerability exists in the D-Link DIR-X3260 that stems from a SetSysEmailSettings EmailTo command injection remote code execution vulnerability...

WordPress Salon booking system plugin <= 9.6.5 - Editor+ Stored XSS via Email Settings vulnerability

Editor+ Stored XSS via Email Settings vulnerability discovered by Bob Matyas in WordPress Plugin Salon booking system versions = 9.6.5...

CVE-2024-2603 Salon booking system <= 9.6.5 - Editor+ Stored XSS via Email Settings

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration to perform Stored Cross-Site Scripting attacks...

CVE-2024-2603 Salon booking system <= 9.6.5 - Editor+ Stored XSS via Email Settings

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration to perform Stored Cross-Site Scripting attacks...

WP Prayer <= 2.0.9 - Email Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack Make a logged in admin open an HTML file containing:...

WP Prayer <= 2.0.9 - Email Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its email settings, which could allow attackers to make a logged in admin change them via a CSRF attack PoC Make a logged in admin open an HTML file containing:...

Salon booking system < 9.6.6 - Editor+ Stored XSS via Email Settings

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin or editor depending on plugin configuration to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

TELSAT marKoni FM Transmitter 1.9.5 - Root Command Injection

!/usr/bin/env python TELSAT marKoni FM Transmitter 1.9.5 Root Command Injection PoC Exploit Vendor: TELSAT Srl Product web page: https://www.markoni.it Affected version: Markoni-D Compact FM Transmitters Markoni-DH Exciter+Amplifiers FM Transmitters Markoni-A Analogue Modulator FM Transmitters...

BIT-DISCOURSE-2022-46150 Discourse may allow exposure of hidden tags in the subject of notification emails

Discourse is an open-source discussion platform. Prior to version 2.8.13 of the stable branch and version 2.9.0.beta14 of the beta and tests-passed branches, unauthorized users may learn of the existence of hidden tags and that they have been applied to topics that they have access to. This issue...

TELSAT marKoni FM Transmitter 1.9.5 Root Command Injection

!/usr/bin/env python TELSAT marKoni FM Transmitter 1.9.5 Root Command Injection PoC Exploit Vendor: TELSAT Srl Product web page: https://www.markoni.it Affected version: Markoni-D Compact FM Transmitters Markoni-DH Exciter+Amplifiers FM Transmitters Markoni-A Analogue Modulator FM Transmitters...

CVE-2024-22549

FlyCms 1.0 is vulnerable to Cross Site Scripting XSS in the email settings of the website settings section...

CVE-2024-22549

FlyCms 1.0 is vulnerable to Cross Site Scripting XSS in the email settings of the website settings section...

Cross site scripting

FlyCms 1.0 is vulnerable to Cross Site Scripting XSS in the email settings of the website settings section...

PT-2024-19481 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is related to Cross Site Scripting XSS in the email settings of the website settings section. This allows for potential malicious script injection. Recommendations: For FlyCms version 1.0, as a...

CVE-2024-22549

FlyCms 1.0 is vulnerable to Cross Site Scripting XSS in the email settings of the website settings section...

CVE-2024-22549

FlyCms 1.0 is vulnerable to Cross Site Scripting XSS in the email settings of the website settings section...

CVE-2024-22549

FlyCms 1.0 is reported vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section. The affected component is the email settings area within FlyCms 1.0; the available documents do not provide root-cause specifics or formal patch details. Exploitation status is n...