Stored XSS Vulnerability in ForestBlog Frontend

ForestBlog is a simple SSM blogging system. A stored XSS vulnerability exists in the ForestBlog frontend that can be exploited by an attacker to obtain an administrator cookie...

Command Execution Vulnerability in Frontend of Shining Enterprise Website Builder System

Zibo Shining Network Technology Co., Ltd. in November 2014, the company's business scope includes: computer software, hardware development and sales, Internet technology development, technical services and so on. Shining enterprise website building system foreground there is a command execution...

[20210307] - Core - ACL violation within com_content frontend editing

Incorrect ACL checks could allow unauthorized change of the category for an article...

HTTP Request Smuggling in Agoo

agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be...

SQL Injection Vulnerability in ZZCMS Frontend (CNVD-2020-59408)

ZZCMS is a content management system. A SQL injection vulnerability exists in the frontend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in YYcms Frontend Login Page

YYCMS movie and television, rain rain CMS movie and television, is a fully automatic collection of video sites. YYcms foreground login page exists SQL injection vulnerability, attackers can use the vulnerability to obtain database sensitive information...

Shield Spirit Original Article Submission System 1.0 SQL Injection Vulnerability in Frontend

Shield Spirit Original Article Submission System 1.0 is a concise submission system. Shield Spirit Original Article Submission System 1.0 suffers from a SQL injection vulnerability in the frontend, which can be exploited by attackers to obtain sensitive information from the database...

Open-Xchange: XSS - Notes - Attribute injection through overlapping tags

The Notes app uses simple markup language to format the content, which is later converted to HTML for display. javascript // frontend/ui/apps/io.ox/notes/parser.js parsePlainText: function text var lines = .escapetext.split/\n/, openList; ... var html = lines.join'' .replace/!\.?/g, ''...

GHSA-F7WM-X4GW-6M23 Contao Insert tag injection in forms

Impact It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Patches Update to Contao 4.4.52, 4.9.6 or 4.10.1. Workarounds Disable the front end login form and do not use form fields with array keys such as fieldname. References...

Logic Flaw Vulnerability in PCFCMS Frontend

PCFCMS is based on TP6.0 + framework for the core development of simple + general content management system. There is a logic flaw vulnerability in the frontend of PCFCMS, which can be exploited by attackers to obtain sensitive information...

SQL Injection Vulnerability in e-cology 8.0 Frontend of Shanghai Panmicro Network Technology Co.

e-cology is a collaboration platform. A SQL injection vulnerability exists in the frontend of e-cology 8.0 of Shanghai Panmicro Networks Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...

HTTP Request Smuggling

squid3 is vulnerable to HTTP request smuggling. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between a client and Squid with attacker-controlled content ...

SQL Injection Vulnerability in Aj***.ashx File of CMS Web Publishing System of Nanjing Yu Hou Network Technology Co.

Nanjing Yu Hou Network Technology Co., Ltd. is a provider and successful practitioner of regional education informatization and school wisdom education solutions, has provided education informatization software system development and services for a number of cities, districts and schools. A SQL...

ZZCMS 2020 Frontend SQL Injection Vulnerability

ZZCMS is a content management system for Webmaster Merchants. A SQL injection vulnerability exists in the ZZCMS 2020 frontend, which can be exploited by attackers to obtain sensitive information from the database...

@knonginda/base (>=1.0.3, <=1.0.27), cneport-core-frontend (>=1.0.40, <=1.0.58) +3 more potentially affected by unknown CVE via vue-moment (4.0.0)

vue-moment NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vue-moment and may be impacted: - @knonginda/base =1.0.3, =1.0.40, =1.0.1, =1.0.48, =1.0.9, =1.2.37 Source cves: unknown CVE Source advisory: OSV:GHSA-HRPP-F84W-XHFG...

@0negativ/hawtio-integration (>=4.13.7-rc4, <=4.13.7-rc5), @atlasmap/atlasmap.data.mapper (>=1.32.0-SNAPSHOT.20180129121405, <=1.34.0-SNAPSHOT.20180420142818) +105 more potentially affected by unknown CVE via bootstrap-select (>=1.7.3, <=1.13.5)

bootstrap-select NPM version =1.7.3, =4.13.7-rc4, =1.32.0-SNAPSHOT.20180129121405, =1.0.0, =2.0.0, =1.0.0, =1.0.0, =3.2.13, =3.0.11, =3.0.1, =3.0.7, =3.2.17, =5.4.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9R7H-6639-V5MW...

norska (>=0.7.0, <=0.8.4), norska-frontend (>=0.7.4, <=0.9.11) +5 more potentially affected by unknown CVE via lazysizes (>=5.1.1, <=5.2.0)

lazysizes NPM version =5.1.1, =0.7.0, =0.7.4, =0.7.4, =2.1.4, =0.5.2, =0.5.2, =0.7.2 - sov 0.2.4 Source cves: unknown CVE Source advisory: OSV:GHSA-W4VP-3MQ7-7V82...

Dropcontact: User registration using public domain email like gmail in place of professional email.

Like sais in the title, we were only checking and restricting professional email in frontend, which led to being able to register with an email which is not pro because we were not checking this info in the backend. User was able to register with public domain email like gmail by response...

CVE-2020-12606

An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xpcmdshell stored...

Sql injection

An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xpcmdshell stored...