Cross site scripting

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to...

CVE-2021-31682: Improper Neutralization of Input During Web Page Generation

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to...

ECOA BAS controller directory traversal vulnerability

ECOA BAS controller is a smart lighting control solution. A directory traversal vulnerability exists in the ECOA BAS controller GET parameter handling, which can be exploited by attackers to delete arbitrary files on the affected device and cause a denial of service scenario...

CVE-2021-24679

The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-24679: Improper Neutralization of Input During Web Page Generation

The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue...

CVE-2021-41294

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario...

Path traversal

ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device...

CVE-2021-41294 ECOA BAS controller - Path Traversal-4

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario...

Ecoa Bas controller 路径遍历漏洞

ECOA BAS controller is a smart lighting control solution. A directory traversal vulnerability exists in the ECOA BAS controller GET parameter handling, which can be exploited by attackers to delete arbitrary files on the affected device and cause a denial of service scenario...

CVE-2020-20692

GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $GET parameter in /src/core/controllers/cm.php...

PT-2021-15929

Name of the Vulnerable Software and Affected Versions GSEOR – WordPress SEO Plugin versions through 1.3 Description The issue arises from the pageid GET parameter not being sanitised, escaped, or validated before being inserted into a SQL statement, leading to SQL injection. This allows for...

CVE-2021-24510

The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue...

Cross-site Scripting (XSS) - Reflected in yourls/yourls

✍️ Description Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. The...

Cross-site Scripting (XSS) - Reflected in universaloj/uoj-system

✍️ Description Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. The...

Cross-site Scripting (XSS) - Reflected in podcastgenerator/podcastgenerator

✍️ Description Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. The...

CVE-2021-24392

An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24395

The CVE-2021-24395 entry describes an SQL injection in the WordPress plugin “Embed Youtube Video” (<= 1.0) caused by the editid GET parameter being unsanitized, escaped, or validated before SQL statement insertion. Affected software: WordPress plugin Embed Youtube Video, version

PT-2021-15924

Name of the Vulnerable Software and Affected Versions Cashtomer WordPress plugin versions 1.0.0 and earlier Description The issue arises from the editid GET parameter of the Cashtomer WordPress plugin, which is not properly sanitised, escaped, or validated before being inserted into a SQL...

PT-2021-15926

Name of the Vulnerable Software and Affected Versions Comment Highlighter WordPress plugin versions 0.13 and earlier Description The issue arises from a c GET parameter in the Comment Highlighter WordPress plugin that is not properly sanitized, escaped, or validated before being inserted into a S...

PT-2021-15925

Name of the Vulnerable Software and Affected Versions WordPress Membership SwiftCloud.io WordPress plugin versions 1.0 and earlier Description The issue arises from the improper sanitization, escaping, or validation of the id GET parameter in the WordPress Membership SwiftCloud.io WordPress plugi...