240 matches found
SourceCodester Simple Student Attendance System SQL Injection Vulnerability
Simple Student Attendance System is a simple student attendance system. SourceCodester Simple Student Attendance System version 1.0 has a SQL injection vulnerability that originates from a SQL injection vulnerability in the file /modals/classform.php...
CVE-2023-41136
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Laurence/OhMyBox.Info Simple Long Form allows Stored XSS.This issue affects Simple Long Form: from n/a through 2.2.2...
TYPO3 安全漏洞
TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Association in Switzerland. A security vulnerability exists in versions of TYPO3 prior to 2.1.2 that stems from an inability to check if the required CAPTCHA field is submitted in form data, allowing remote...
PYSEC-2023-108
MechanicalSoup is a Python library for automating interaction with websites. Starting in version 0.2.0 and prior to version 1.3.0, a malicious web server can read arbitrary files on the client using a inside HTML form. All users of MechanicalSoup's form submission are affected, unless they took...
Exploit for Deserialization of Untrusted Data in Spip
---- CVE-2023-273...
PT-2023-21181 · WordPress · Upload Resume Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: Upload Resume WordPress plugin versions 1.2.0 and earlier Description: The issue allows unauthenticated visitors to upload arbitrary media files to the site due to a lack of validation of the captcha parameter when uploading a resume via the...
Danfoss AK-EM100 web applications SQL注入漏洞
Danfoss AK-EM100 web applications is a web application from Danfoss, Denmark. It provides a web-based graphical user interface to the store that allows a range of everyday users to locally or remotely monitor data, alarms, and reports on all of their refrigeration equipment. A security...
WordPress Plugin WordPress Automatic 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
Contact Form Builder by vcita < 4.10.2 - Contributor+ Stored Cross-Site Scripting
The plugin does not sanitize and escape the email parameter in the plugin settings, which could allow users with roles as low as contributor to inject arbitrary web scripts targeting higher privileged users, such as administrators, into the plugin settings...
Exploit for Code Injection in Reportlab
eScan Management Console 14.0.1400.2281 - Reflected Cross Sit...
The vulnerability of the /goform/formLogin component in the D-Link DIR-816 A2 microprogramming router software allows a hacker to execute arbitrary code.
The vulnerability of the /goform/Diagnosis component of D-Link DIR-816 A2 microprogrammed software lies in the writing of data beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
CVE-2023-29836
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions EUCS v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form...
CVE-2022-25278
Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should not have access to. No forms provided by Drupal core are known to be vulnerable. However, forms added through contributed or custom modules...
Tiempo.com <= 0.1.2 - Stored XSS via CSRF
The plugin does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Make a logged in admin open a page with the code below input type="hid...
Pickup | Delivery | Dine-in date time <= 1.0.9 - Admin+ Stored XSS
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Go to this page:...
Hardcoded credentials
The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to...
The vulnerability of the LoginForm and RegisterForm data transmission forms in the Apex-VUZ automation system allows a perpetrator to gain access to user account information.
The vulnerability of the LoginForm and RegisterForm data transmission forms in the Apex-VUZ automation system is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to gain access to user credentials...
Cross site scripting
Cross site scripting XSS vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form...
SA45653 - Cross-site Request Forgery in Login Form
Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. In a login CSRF attack, the attacker forges a login request to an honest site using the attacker’s username and password at that site. If the forgery succeeds, the honest server...