1244 matches found
Cross Site Scripting (XSS)
decidim is vulnerable to Cross Site Scripting XSS. The vulnerability is due to the pagination feature used in searches and filters, which is susceptible XSS through a malformed URL using the GET parameter perpage. An attacker can exploit this by crafting a malicious URL to execute arbitrary scrip...
CVE-2024-32469 Decidim has cross-site scripting (XSS) in the pagination
Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter perpage. This vulnerability is fixed in 0.27.6 and 0.28.1...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the pagination feature used in searches and filters by injecting a malformed URL into the GET parameter perpage Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker...
CVE-2024-3798
CVE-2024-3798 concerns Phoniebox where insecure handling of a GET header parameter file in requests can trigger a website to cause malicious requests to hosts on the local network. The underlying flaw is improper processing of the header parameter, enabling a payload that may lead to shell comman...
PT-2024-27875 · Concept Intermedia · S@M Cms
Name of the Vulnerable Software and Affected Versions: S@M CMS Concept Intermedia affected versions not specified Description: The issue concerns a Reflected XSS vulnerability that can be exploited by including scripts in one of the GET header parameters. It is noted that only a part of the...
The vulnerability in the Web application for managing educational processes, SourceCodester School Task Manager, arises from the failure to protect the SQL query structure. This allows attackers to gain unauthorized access to the application’s database.
The vulnerability of the Web-based School Process Management Application SourceCodester School Task Manager is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to gain unauthorized access to the...
CVE-2024-31847
An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...
CVE-2024-31847
An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...
PT-2024-24242 · Italtel · Italtel Embrace
Name of the Vulnerable Software and Affected Versions: Italtel Embrace version 1.6.4 Description: An issue was discovered in the product where it does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter, whic...
PT-2024-24244 · Italtel · Italtel Embrace
Name of the Vulnerable Software and Affected Versions: Italtel Embrace version 1.6.4 Description: A stored cross-site scripting XSS issue allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input...
CVE-2024-4860
The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...
CVE-2024-4860
CVE-2024-4860 affects the WordPress plugin RSS Aggregator (WP RSS Aggregator) for versions < 4.23.9. The issue is a Cross‑Site Scripting (XSS) vulnerability caused by insufficient sanitization of the notice_id GET parameter. Connected sources confirm the detail and note the specific affected r...
The vulnerability in the script htdocs/webinc/js/bsc_sms_inbox.php of the D-Link DIR-845L router’s microprogramming software allows a attacker to perform XSS attacks.
The vulnerability in the script htdocs/webinc/js/bscsmsinbox.php of the D-Link DIR-845L router operating system allows an attacker to exploit the system by manipulating the $GET"Treturn" parameter during page processing. Exploiting this vulnerability enables a remote attacker to perform XSS attac...
osCommerce 4 Cross Site Scripting
Exploit Title: osCommerce 4 - Reflected XSS Exploit Author: skalvin Date: 22/04/2024 Vendor: osCommerce ltd. Vendor Homepage: https://www.oscommerce.com/ Software Link: https://demo.oscommerce.com/ Demo Link: https://demo.oscommerce.com/furniture/ Tested on: Windows 11 Pro Impact: Manipulate the...
CVE-2024-30214
CVE-2024-30214 concerns SAP Business Connector. The connected documents confirm a cross-site scripting (XSS) vulnerability where an attacker with high privileges can append a malicious GET query parameter to Service invocations that are reflected in the server response, potentially allowing clien...
The vulnerability of the virtual learning environment Moodle, related to the lack of security measures for the website structure, allows attackers to gain access to read, modify, or delete data, as well as execute cross-site attacks.
The vulnerability in the virtual training environment Moodle is related to the lack of measures taken to protect the structure of the web page during the processing of the GET /?lang= parameter. Exploiting this vulnerability can allow a malicious actor to gain access to read, modify, or delete...
CVE-2024-2669 Campcodes Online Job Finder System GET Parameter controller.php sql injection
A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/employee/controller.php of the component GET Parameter Handler. The manipulation of the argument EMPLOYEEID leads to sql injection. The...
BIT-PRESTASHOP-2023-30151
A SQL injection vulnerability in the Boxtal envoimoinscher module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the key GET parameter...
The vulnerability of the sub_41C488() function in D-Link DIR-823G router’s software allows a hacker to induce a service failure.
The vulnerability of the sub41C488 function in D-Link DIR-823G router microprogramming software is related to errors in pointer manipulation during the processing of the GET parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...