CVE-2024-3798

CVE-2024-3798 concerns Phoniebox where insecure handling of a GET header parameter file in requests can trigger a website to cause malicious requests to hosts on the local network. The underlying flaw is improper processing of the header parameter, enabling a payload that may lead to shell comman...

CVE-2024-32469: Improper Neutralization of Input During Web Page Generation

Decidim is a participatory democracy framework. The pagination feature used in searches and filters is subject to potential XSS attack through a malformed URL using the GET parameter perpage. This vulnerability is fixed in 0.27.6 and 0.28.1...

PT-2024-27875 · Concept Intermedia · S@M Cms

Name of the Vulnerable Software and Affected Versions: S@M CMS Concept Intermedia affected versions not specified Description: The issue concerns a Reflected XSS vulnerability that can be exploited by including scripts in one of the GET header parameters. It is noted that only a part of the...

The vulnerability in the Web application for managing educational processes, SourceCodester School Task Manager, arises from the failure to protect the SQL query structure. This allows attackers to gain unauthorized access to the application’s database.

The vulnerability of the Web-based School Process Management Application SourceCodester School Task Manager is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to gain unauthorized access to the...

CVE-2024-25737

A Server-Side Request Forgery SSRF vulnerability in the /Cover/Show route showAction in CoverController.php in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting XSS attacks by proxying arbitrary URL...

CVE-2024-25737: Improper Neutralization of Input During Web Page Generation

A Server-Side Request Forgery SSRF vulnerability in the /Cover/Show route showAction in CoverController.php in Open Library Foundation VuFind 2.4 through 9.1 before 9.1.1 allows remote attackers to access internal HTTP servers and perform Cross-Site Scripting XSS attacks by proxying arbitrary URL...

CVE-2024-31847

An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...

CVE-2024-31847

An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...

PT-2024-24244 · Italtel · Italtel Embrace

Name of the Vulnerable Software and Affected Versions: Italtel Embrace version 1.6.4 Description: A stored cross-site scripting XSS issue allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input...

PT-2024-24242 · Italtel · Italtel Embrace

Name of the Vulnerable Software and Affected Versions: Italtel Embrace version 1.6.4 Description: An issue was discovered in the product where it does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter, whic...

CVE-2024-31847: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...

CVE-2024-4860

The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...

CVE-2024-4860

CVE-2024-4860 affects the WordPress plugin RSS Aggregator (WP RSS Aggregator) for versions < 4.23.9. The issue is a Cross‑Site Scripting (XSS) vulnerability caused by insufficient sanitization of the notice_id GET parameter. Connected sources confirm the detail and note the specific affected r...

CVE-2024-4860: Improper Neutralization of Input During Web Page Generation

The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...

The vulnerability in the script htdocs/webinc/js/bsc_sms_inbox.php of the D-Link DIR-845L router’s microprogramming software allows a attacker to perform XSS attacks.

The vulnerability in the script htdocs/webinc/js/bscsmsinbox.php of the D-Link DIR-845L router operating system allows an attacker to exploit the system by manipulating the $GET"Treturn" parameter during page processing. Exploiting this vulnerability enables a remote attacker to perform XSS attac...

osCommerce 4 Cross Site Scripting

Exploit Title: osCommerce 4 - Reflected XSS Exploit Author: skalvin Date: 22/04/2024 Vendor: osCommerce ltd. Vendor Homepage: https://www.oscommerce.com/ Software Link: https://demo.oscommerce.com/ Demo Link: https://demo.oscommerce.com/furniture/ Tested on: Windows 11 Pro Impact: Manipulate the...

CVE-2024-30214

CVE-2024-30214 concerns SAP Business Connector. The connected documents confirm a cross-site scripting (XSS) vulnerability where an attacker with high privileges can append a malicious GET query parameter to Service invocations that are reflected in the server response, potentially allowing clien...

The vulnerability of the virtual learning environment Moodle, related to the lack of security measures for the website structure, allows attackers to gain access to read, modify, or delete data, as well as execute cross-site attacks.

The vulnerability in the virtual training environment Moodle is related to the lack of measures taken to protect the structure of the web page during the processing of the GET /?lang= parameter. Exploiting this vulnerability can allow a malicious actor to gain access to read, modify, or delete...

CVE-2024-2669 Campcodes Online Job Finder System GET Parameter controller.php sql injection

A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/employee/controller.php of the component GET Parameter Handler. The manipulation of the argument EMPLOYEEID leads to sql injection. The...

CVE-2024-2669: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/employee/controller.php of the component GET Parameter Handler. The manipulation of the argument EMPLOYEEID leads to sql injection. The...