Design/Logic Flaw

OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release...

CVE-2021-38138

OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release...

OneNav 跨站脚本漏洞

OneNav is a minimalist navigation/bookmark management system developed using PHP. OneNav beta 0.9.12 suffers from a cross-site scripting vulnerability, which allows attackers to conduct XSS attacks via the Add Link feature...

CVE-2021-22923

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often...

CVE-2021-22922

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and...

WhatsApp Introduces View Once Feature for Videos and Photos

By Deeba Ahmed View Once feature will keep the images accessible for a maximum of 14 days, and they will expire afterward. This is a post from HackRead.com Read the original post: WhatsApp Introduces View Once Feature for Videos and Photos...

CVE-2021-38113

In addBouquet in js/bqe.js in OpenWebif aka e2openplugin-OpenWebif through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor i.e., bouqueteditor/api/addbouquet?name= leads to Stored XSS...

Sql injection

A SQL injection vulnerability in a MediaWiki script in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote unauthenticated attackers to execute arbitrary SQL commands via the hostname and servicedescription parameters. The vulnerability can be exploited only when a valid Knowledge Base U...

Hotel Management System 1.0 - Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution (RCE)

Exploit Title: Hotel Management System 1.0 - Cross-Site Scripting XSS Arbitrary File Upload Remote Code Execution RCE Date: 2021-08-01 Exploit Author: Merbin Russel Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/?smdprocessdownload=1&downloadid=7204 Version: V1.0...

CVE-2021-24371

The Import feature of the RSVPMaker WordPress plugin before 8.7.3 /wp-admin/tools.php?page=rsvpmakerexportscreen takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network...

Remote code execution in workflow import - CVE-2017-18113

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution RCE vulnerability which allowed for various...

Remote code execution in workflow import - CVE-2017-18113

The DefaultOSWorkflowConfigurator class in Jira Server and Jira Data Center before version 8.18.1 allows remote attackers who can trick a system administrator to import their malicious workflow to execute arbitrary code via a Remote Code Execution RCE vulnerability which allowed for various...

WordPress 代码注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code injection vulnerability exists in WordPress Plugin Speed Booster that stems from the product'...

Navigate CMS Cross-Site Scripting Vulnerability (CNVD-2021-57427)

Navigate CMS, a powerful and intuitive content management system, is vulnerable to a cross-site scripting vulnerability in Navigate CMS version 2.9. The vulnerability can be exploited to conduct cross-site scripting attacks via the "Create" or "Edit" function of the "Tools" feature...

CVE-2020-23241

Cross Site Scripting XSS vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News Article" feature...

Cross site scripting

Cross Site Scripting XSS vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature...

Cross site scripting

Cross Site Scripting XSS vulnerability in NavigateCMS NavigateCMS 2.9 via the name="wrongpathredirect" feature...

CVE-2020-23242

Cross Site Scripting XSS vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature...

OSX.XLoader hides little except its main purpose: What we learned in the installation process

Last week, Check Point Research described a new Mac variant of malware they call XLoader. It was identified as being the successor of something called Formbook, a very prevalent threat in the Windows world. According to Check Point, the Mac version of the malware is being "rented" as part of a...

NavigateCMS和NavigateCMS 跨站脚本漏洞

Navigate CMS, a powerful and intuitive content management system, is vulnerable to a cross-site scripting vulnerability in Navigate CMS version 2.9. The vulnerability can be exploited to conduct cross-site scripting attacks via the "Create" or "Edit" function of the "Tools" feature...