335 matches found
MediaWiki cross-site scripting vulnerability (CNVD-2021-38685)
MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A cross-site scripting vulnerability exists in MediaWiki version 1.34.x prior...
UBUNTU-CVE-2020-25812
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML...
Path traversal
A remote code execution RCE vulnerability was discovered in the htmlformentry aka HTML Form Entry module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed...
CVE-2020-24621
A remote code execution RCE vulnerability was discovered in the htmlformentry aka HTML Form Entry module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed...
CSRF tokens leaked in URL by canned query form
Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitti...
GHSA-Q6J3-C4WC-63VW CSRF tokens leaked in URL by canned query form
Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitti...
PT-2020-21453
Name of the Vulnerable Software and Affected Versions Datasette versions prior to 0.46 Description The HTML form for a read-only canned query in Datasette includes a hidden CSRF token field. When this form is submitted, the CSRF token is exposed in the URL. For example, submitting the form on...
CVE-2019-19987
CVE-2019-19987 affects Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29.0. The vulnerability is a Cross-Site Request Forgery (CSRF) in the web application’s handling of HTML forms, allowing an attacker to abuse functions such as change password, add user, and add privilege. Root c...
PT-2020-10306
Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29 Description The issue allows Cross-Site Request Forgery CSRF on any HTML form, enabling an attacker to abuse functionalities such as changing passwords, adding users, adding...
Pricing Table by Supsystic < 1.8.1 - Cross-Site Request Forgery to XSS and Setting Changes
CSRF can be exploited against any of the functionalities in the Pricing Table by Supsystic WordPress plugin in vulnerable versions. One example:...
Online Book Store 1.0 - Arbitrary File Upload Vulnerability
Exploit for php platform in category web applications Exploit Title: Online Book Store 1.0 - Arbitrary File Upload Exploit Author: Or4nG.M4n aka S4udiExploit Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/ Software Link:...
Stripo Inc: CSRF - Modify Project Settings
Target Url/Endpoint https://my.stripo.email/cabinet/stripeapi/v1/projects/ProjectId Note Attacker just need to know victim project Id. Summary: This CSRF Vulnerability leads to change user's project settings including General Information, Contacts, Social Networks and Other Options. Steps To...
Exploit for Cross-Site Request Forgery (CSRF) in Oneidentity Cloud_Access_Manager
CVE-2019-13497 Exploit Title: Cross Site Request Forgery CSR...
V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery
Exploit Title: V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery Author: LiquidWorm Discovery Date: 2019-09-26 Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd. Product web page: https://www.vsolcn.com Tested on: GoAhead-Webs Advisory ID: ZSL-2019-5536 Advisory URL:...
CVE-2019-5590
The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...
Cross site scripting
The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...
CVE-2019-5590: Improper Neutralization of Input During Web Page Generation
The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...
CVE-2019-6968
The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected...