PT-2024-15748 · WordPress · The Ninja Forms Contact Form – The Drag/Drop Form Builder For Wordpress

Name of the Vulnerable Software and Affected Versions: The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress versions up to, and including, 3.7.1 Description: The issue is related to Second Order SQL Injection via the email address value submitted throug...

SUSE CVE-2023-45150

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended th...

Nextcloud Resource Management Error Vulnerability

Nextcloud is an open source suite of self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A resource management error vulnerability exists in Nextcloud calendar version 1.0.0 and later versions, which stems from a lack of precondition checking,...

Event Management System 跨站脚本漏洞

Event Management System is an event management system. A cross-site scripting XSS vulnerability exists in SourceCodester Royale Event Management System version 1.0, which originates from an unknown function in the file /royalevent/companyprofile.php, where manipulation of the parameters...

Pharmacy Management System SQL注入漏洞

Pharmacy Management System MPMS is a multilingual pharmacy management system from the personal developer Mayuri K. A SQL injection vulnerability exists in Pharmacy Management System v1.0, which stems from the electronic email and password in login.php Lack of validation of externally entered SQL...

Improper handling of email input

Impact An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: [email protected], Before signing in, claim your money!. This was previously sent to...

CVE-2022-31127 Improper handling of email input in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...

CVE-2022-31127 Improper handling of email input in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...

The microweber application allows large characters to insert in the input field "Email" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request

POC: 1. Go to home page http://127.0.0.1/ and there will a option to signup with email and phone number with 3 check box 2. Screenshot: -- https://ibb.co/F3tPVWY 3. Fill the email parameter with huge characters 4. when the admin check the notification http://127.0.0.1/admin/notification it will b...

CVE-2020-36498

Macrob7 Macs Framework Content Management System - 1.14f contains a cross-site scripting XSS vulnerability in the account reset function, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the e-mail input field...

Zenar Content Management System 跨站脚本漏洞

Zenar Content Management System is an open source content management system CMS from the Zenar team. A cross-site scripting vulnerability exists in the Macrob7 Macs Framework Content Management System, which stems from a cross-site scripting XSS vulnerability contained in the account reset featur...

Wordpress Testimonials Widget 跨站脚本漏洞

Wordpress Testimonials Widget is Wordpress open source an application plugin . Provide testimonials function. A cross-site scripting vulnerability exists in Testimonials Widget WordPress plugin versions prior to 4.0.0. The vulnerability stems from the program not properly validating input and not...

CVE-2020-14230

HCL Domino is susceptible to a Denial of Service vulnerability caused by improper validation of user-supplied input. A remote unauthenticated attacker could exploit this vulnerability using a specially-crafted email message to hang the server. Versions previous to releases 9.0.1 FP10 IF6, 10.0.1...

Automattic: XSS in Email Input [intensedebate.com]

Summary: I found an XSS in Email input. This input is not sanitized like other inputs allowing user to execute xss payloads. Platforms Affected: https://www.intensedebate.com/edit-user-account Steps To Reproduce: 1. Navigate to your account. 2. In email address, add the below payload next to your...

Alfresco sql injection vulnerability

Alfresco is an open source enterprise content management system. The platform page using Freemarker development , the main features include document management , collaboration , records management , knowledge base management , Web content management and so on. A sql injection vulnerability exists...

CVE-2020-25727

The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field...

CVE-2020-25727

The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field...

Sql injection

The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within the email input field...

Nextcloud: Denial of Service when entring an Array in email at seetings

in settings https://demo2.nextcloud.com/index.php/settings/users/TweLbFT93aqRnEfF/settings when you submit the request with email value Array the server return 500 Internal Server Error Poc video: F954435 Impact denial a service attack on the server. This may lead to the website becoming slow or...

U.S. Dept Of Defense: Reflected XSS - in Email Input

Target Url https://█████ Summary: Hello, I found a reflected xss injection in the email input when updating user profile. Seems Email input is not sanitized and the special characters are not encoded. xss payload used " Step-by-step Reproduction Instructions 1. Navigate to the target url...