172 matches found
CVE-2021-38710
Static Persistent XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITENAME parameter...
Cross site scripting
Static Persistent XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITENAME parameter...
PT-2021-22271
Name of the Vulnerable Software and Affected Versions Yclas version 4.3.0 Description A Static Persistent XSS issue exists when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITE NAME parameter. Recommendations For Yclas version 4.3.0, as...
CVE-2021-38710: Improper Neutralization of Input During Web Page Generation
Static Persistent XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITENAME parameter...
PT-2021-17399
Name of the Vulnerable Software and Affected Versions Triconsole Datepicker Calendar versions prior to 3.77 Description The issue affects the calendar form.php file, allowing attackers to perform cross-site scripting XSS attacks. This can lead to the reading of authentication cookies that are sti...
PT-2020-17375
Name of the Vulnerable Software and Affected Versions Uncanny Groups for LearnDash versions prior to 3.7 Description Multiple cross-site scripting XSS vulnerabilities allow authenticated remote attackers to inject arbitrary JavaScript or HTML via various parameters. The affected parameters includ...
CVE-2020-35650: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...
PT-2020-14679
Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.65.1 Description The issue allows an authenticated attacker to achieve SQL Injection. This is possible via the device id POST parameter to the "ajax form.php" endpoint. Recommendations For versions prior to 1.65.1,...
CVE-2020-11727
A cross-site scripting XSS vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woeposttype parameter...
CVE-2020-11727: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in the AlgolPlus Advanced Order Export For WooCommerce plugin 3.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the view/settings-form.php woeposttype parameter...
CVE-2019-16967: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Manager 13.x before 13.0.2.6 and 15.x before 15.0.6 before FreePBX 14.0.10.3. In the Manager module form html\admin\modules\manager\views\form.php, an unsanitized managerdisplay variable coming from the URL is reflected in HTML, leading to XSS. It can be requested via G...
CVE-2019-11378
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...
CVE-2019-11378
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...
PT-2019-12269
Name of the Vulnerable Software and Affected Versions ProjectSend version r1053 Description An issue was discovered that allows directory traversal through the upload-process-form.php file, potentially enabling users to read arbitrary files, access the supporting database, delete arbitrary files,...
CVE-2019-11378: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in ProjectSend r1053. upload-process-form.php allows finishedfiles=../ directory traversal. It is possible for users to read arbitrary files and potentially access the supporting database, delete arbitrary files, access user passwords, or run arbitrary code...
PT-2019-9466
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description A security issue exists due to the presence of XSS in the /uploadimg form.php noshuiyin parameter. Recommendations For zzcms version 8.3, avoid using the noshuiyin parameter in the /uploadimg form.php endpoint unt...
PT-2018-14480
Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 1.44 Description The issue allows remote attackers to inject arbitrary web script or HTML via the dashboard name parameter in the "/ajax form.php" API endpoint, related to files such as...
thechinatravelcompany.co.uk XSS vulnerability
Open Bug Bounty ID: OBB-680334 Description| Value ---|--- Affected Website:| thechinatravelcompany.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
waveneyrush.co.uk XSS vulnerability
Open Bug Bounty ID: OBB-651394 Description| Value ---|--- Affected Website:| waveneyrush.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...