CVE-2024-51031

CVE-2024-51031 Description A Cross-site Scripting XSS vulnerability in manageaccount.php in Sourcecodester Cab Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "First Name," "Middle Name," and "Last Name" fields. Vulnerability Type Cross Site Scripti...

CVE-2023-36159

CVE-2023-36159 Cross Site Scripting XSS vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page...

CVE-2023-36158

CVE-2023-36158 Cross Site Scripting XSS vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page...

poc-CVE-2026-23489

POC CVE-2026-23489 Prova di concetto per la CVE-2026-23489 del plugin "Fields" di GLPI --cookie-value COOKIEVALUE GLPI session cookie value --php PHP Raw PHP to execute on the server end statements with ';', Dropdowns...

CVE-2024-55040-Sensaphone-XSS

DIVULGAZIONE DELLA VULNERABILITÀ SENSAPHONE Sommario A metà settembre 2024, ho identificato diversi problemi di sicurezza di gravità medio-bassa nel Sensaphone Web600 Monitoring System, incluse vulnerabilità di cross-site scripting XSS memorizzato nelle opzioni Setup, Profile e Zone del sistema...

CVE-2021-35956

CVE-2021-35956. Proof of Concept Exploit per CVE-2021-35956, AKCP sensorProbe - 'Multiple' Cross Site Scripting XSS. Titolo Exploit: AKCP sensorProbe - 'Multiple' Cross Site Scripting XSS. Data: 07-01-2021. Autore Exploit: Tyler Butler. Homepage del fornitore: https://www.akcp.com/. Link software...

birp

Big Iron Recon & Pwnage BIRP di @singe Dominic White @ SensePost Panoramica BIRP è uno strumento che aiuta nella valutazione della sicurezza di applicazioni mainframe servite su TN3270. Proprio come BURP e altri proxy per applicazioni web fanno per i test su applicazioni web, BIRP mira a fare lo...

CVE-2023-31584

CVE-2023-31584 - Cross-Site-Scripting-Schwachstelle in cu/silicon GitHub-Link: https://github.com/cu/silicon Betroffene Version: 1 Schweregrad und CVSS: Wird aktualisiert, sobald die Überprüfung durch NIST abgeschlossen ist. Typ: Cross-Site-Scripting Grundursache: Fehlende ordnungsgemäße...

CVE-2020-15052

CVE-2020-15052 : Artica Proxy antes da versão 4.28.030418 Community Edition permite SQL Injection. Product Description: A Artica Tech oferece uma solução poderosa mas simples de usar, geralmente reservada a grandes empresas e multinacionais. Com um preço inicial de apenas 99€ e mais de 62 000...

CVE-2020-15051

CVE-2020-15051 : Artica Proxy prima della versione 4.28.030418 Community Edition permette Cross Site Scripting Memorizzato. Descrizione del prodotto: Artica Tech offre una soluzione potente ma semplice da usare, solitamente riservata alle grandi aziende e multinazionali. Con un prezzo di partenza...

CVE-2022-24086

CVE-2022-24086 Testato con: magento 2.4.3 e dati di esempio Immagine Docker: docker.io/bitnami/magento:2.4.3-debian-10-r0 Nome: root@kitploit: var this.getTemplateFilter.filter$order.shippingaddress.cityvar...

CVE-2026-81820

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2026-81698 openssl_encrypt before 1.4.9 Shell Injection via info command

opensslencrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like peppername containing shell commands that execute when users copy the...

CVE-2026-81698

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block . The root cause is that untrusted metadata fields (such as pepper_name) are interpolated without quoting, allowing an attacker to craft metadata values containing shell com...

CVE-2018-1000529

CVE-2018-1000529 NVD CVE-2018-1000529: https://nvd.nist.gov/vuln/detail/CVE-2018-1000529 MITRE CVE-2018-1000529: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1000529 XSS persistente nel plugin Grails Fields =2.2.7 Questo repository è stato utilizzato per dimostrare una proof of concept del...

EUVD-2026-67131

Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: object UUID; object name; attribute value; attribute type; comment; first/last seen values; IDS flag. Those values were concatenated directly into HTML strings before rendering. The...

CVE-2021-43032

CVE-2021-43032 In XenForo ≤ 2.2.7, un attore malintenzionato con accesso al pannello di amministrazione può salvare payload di cross-site scripting in qualsiasi funzione dell'applicazione che accetta codice HTML. Un payload inserito nella funzionalità 'Advertising' verrà eseguito globalmente sul...

CVE-2026-77035

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...

CVE-2026-77035

Joomla Event Manager (joomlaeventmanager.net) versions prior to 5.0.1 are affected by a cross-user event and venue takeover vulnerability. A registered user with edit-own rights (via the eventowner=1 setting or core.edit.own permission) can forge form fields by POSTing another user's record ID to...

CVE-2026-77035 Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager 5.0.1 - A registered user with edit-own rights the eventowner=1 setting or core.edit.own can POST another user's record id together with their own id as createdby and...