Command injection

FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the editprofilefirstname parameter to user/editprofile...

FS Lynda Clone Cross-Site Scripting Vulnerability

FS Lynda Clone is a video tutorial software developed with jQuery, PHP and MySQL. A cross-site scripting vulnerability exists in FS Lynda Clone. The vulnerability can be exploited to conduct cross-site scripting attacks via the keywords parameter of tutorial/ or the editprofilefirstname parameter...

CVE-2017-16819

A stored cross-site scripting vulnerability in the Icon Time Systems RTC-1000 v2.5.7458 and earlier time clock allows remote attackers to inject arbitrary JavaScript in the nameFirst aka First Name field for the employee details page /employee.html that is then reflected in multiple pages where...

Legal Robot: Name can't be numbers or email

Hi Team, I observe a strange behaviour in your registration form. When we are making account and entering the first and last name. According to security concerns you should force user to write their first and last names which actually looks like name for example your should force users that the...

Legal Robot: first name and last name restrictions bypass

A security researcher discovered that the maximum lengths of the first name and last name fields were set to 32 characters at registration and 50 characters when using the profile update form. There was no security impact and no sensitive data was compromised. Thanks to @flashdisk for pointing ou...

CVE-2016-3670

Cross-site scripting XSS vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field...

CVE-2016-1596

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Micro Focus Novell Service Desk before 7.2 allow remote authenticated users to inject arbitrary web script or HTML via a certain 1 user name, 2 tfaClientFirstName, 3 tfaClientLastName, 4 taselectedTopicContent, 5 tforgUnitName, 6...

CubeCart Stored Cross-Site Scripting Vulnerability

CubeCart is an open source PHP e-commerce software system. A stored cross-site scripting vulnerability exists in CubeCart. Due to insufficient filtering of user-supplied data via the "firstname" and "lastname" HTTP POST parameters passed to the "/index.php" script input, a remotely-authenticated...

CubeCart 6.0.10 - Multiple Vulnerabilities

CubeCart 6.0.10 - Multiple Vulnerabilities Advisory ID: HTB23298 Product: CubeCart Vendor: CubeCart Limited Vulnerable Versions: 6.0.10 and probably prior Tested Version: 6.0.10 Advisory Publication: March 2, 2016 without technical details Vendor Notification: March 2, 2016 Vendor Patch: March 16...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

CVE-2013-4753

CVE-2013-4753 affects Claroline 1.11.9 and earlier. The vulnerability is multiple XSS flaws triggered by user input in three fields: (1) Search in inbox (messaging/messagebox.php), (2) First name in auth/profile.php, (3) Speakers in rqAdd action (calendar/agenda.php). The root cause is improper h...

CiviCRM 3.1 < Beta 5 Multiple XSS Vulnerabilities

No description provided by source. Author: h00die [email protected] & Ch3nz [email protected] Software Link: http://sourceforge.net/projects/civicrm/files/civicrm-latest/3.1.beta1/civicrm-3.1.beta1-standalone.tar.gz/download Version: 3.1 Beta 5, Tested on 3.1 Beta 1 Tested on: BT4 pre-final Greetz ...

CVE-2013-7289

Multiple cross-site scripting XSS vulnerabilities in register.php in Andy's PHP Knowledgebase Aphpkb before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the 1 firstname, 2 lastname, 3 email, or 4 username parameter...

CVE-2013-7289

Multiple cross-site scripting XSS vulnerabilities in register.php in Andy's PHP Knowledgebase Aphpkb before 0.95.8 allow remote attackers to inject arbitrary web script or HTML via the 1 firstname, 2 lastname, 3 email, or 4 username parameter...

CVE-2012-1899

Multiple cross-site scripting XSS vulnerabilities in webfolio/admin/users/edit in Webfolio CMS 1.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 First name, 2 Last name or 3 Email required fields...

XWiki Watch Multiple Cross Site Scripting Vulnerabilities

This host is running XWiki Watch and is prone to multiple cross site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbxwikiwatchmultxssvuln.nasl 7276 2017-09-26 11:59:52Z cfischer $ XWiki Watch Multiple Cross Site Scripting Vulnerabilities Authors: Antu Sanadi Copyright: Copyright c...

CVE-2009-4939

Multiple cross-site scripting XSS vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the 1 uid parameter, 2 uid parameter in a loginlookup action, 3 uid parameter in an adminlogin action, 4 campaignid parameter in a createcampaign actio...

CiviCRM 3.1 Beta 5 - Multiple Cross-Site Scripting Vulnerabilities

CiviCRM 3.1 Beta 5 - Multiple Cross-Site Scripting Vulnerabilities Author: h00die [email protected] & Ch3nz [email protected] Software Link: http://sourceforge.net/projects/civicrm/files/civicrm-latest/3.1.beta1/civicrm-3.1.beta1-standalone.tar.gz/download Version: and from being in the same input...