PT-2020-20660

Name of the Vulnerable Software and Affected Versions Uncanny Owl Tin Canny LearnDash Reporting versions prior to 3.4.4 Description The issue allows authenticated remote attackers to inject arbitrary web script or HTML via several parameters, including the search key GET parameter in TinCan Conte...

CVE-2020-26049

Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution...

CVE-2020-26049

Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution...

Design/Logic Flaw

Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution...

CVE-2020-26049

CVE-2020-26049 affects Nifty-PM CPE 2.3 and is due to stored HTML injection in a component/feature, enabling remote arbitrary code execution as described in the CVE overview. The connected Red Hat advisory and NVD entries corroborate the impact as remote code execution via stored HTML injection. ...

CVE-2020-26049

Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution...

SCO Openserver 5.0.7 Cross Site Scripting

Exploit Title: SCO Openserver 5.0.7 - 'section' Reflected XSS Google Dork: inurl:/cgi-bin/manlist?section Discovered Date: 14/06/2020 Author: Ramikan Vendor Homepage: https://www.xinuos.com/products Software Link: https://www.sco.com/products/openserver507/-overview Affected Version: Tested on...

Niftypm Injection Vulnerability

Niftypm is a project management application from Niftypm USA. The application centralizes modern work content and supports features such as chat, tasks, documents, calendars, meetings, and more. Niftypm CPE 2.3 suffers from an injection vulnerability that originates from remote arbitrary code...

CVE-2020-26049: Improper Neutralization of Input During Web Page Generation

Nifty-PM CPE 2.3 is affected by stored HTML injection. The impact is remote arbitrary code execution...

PT-2020-16277

Name of the Vulnerable Software and Affected Versions Nifty-PM CPE version 2.3 Description The issue concerns stored HTML injection, which can lead to remote arbitrary code execution. Recommendations For Nifty-PM CPE version 2.3, update to a version that fixes the stored HTML injection issue to...

SCO Openserver 5.0.7 - 'section' Reflected XSS

Exploit Title: SCO Openserver 5.0.7 - 'section' Reflected XSS Google Dork: inurl:/cgi-bin/manlist?section Discovered Date: 14/06/2020 Author: Ramikan Vendor Homepage: https://www.xinuos.com/products Software Link: https://www.sco.com/products/openserver507/-overview Affected Version: Tested on...

CVE-2020-35479

MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later...

Design/Logic Flaw

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. The right colum...

MediaWiki cross-site scripting vulnerabilities

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. A cross-site scripting vulnerability exists in MediaWiki before version 1.35....

PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting)

Exploit Title: PHPJabbers Appointment Scheduler 2.3 - Reflected XSS Cross-Site Scripting Date: 2020-12-14 Exploit Author: Andrea Intilangelo Vendor Homepage: https://www.phpjabbers.com Software Link: https://www.phpjabbers.com/appointment-scheduler Version: 2.3 Tested on: Latest Version of Deskto...

PHPJabbers Appointment Scheduler 2.3 Cross Site Scripting

Exploit Title: PHPJabbers Appointment Scheduler 2.3 - Reflected XSS Cross-Site Scripting Date: 2020-12-14 Exploit Author: Andrea Intilangelo Vendor Homepage: https://www.phpjabbers.com Software Link: https://www.phpjabbers.com/appointment-scheduler Version: 2.3 Tested on: Latest Version of Deskto...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage with different request parameters, allows remote attackers to inject arbitrary web script or HTML...

PHPJabbers Appointment Scheduler 2.3 Cross Site Scripting

Exploit Title: PHPJabbers Appointment Scheduler 2.3 - Reflected XSS Cross-Site Scripting Date: 2020-12-14 Exploit Author: Andrea Intilangelo Vendor Homepage: https://www.phpjabbers.com Software Link: https://www.phpjabbers.com/appointment-scheduler Version: 2.3 Tested on: Latest Version of Deskto...

CVE-2020-29303

A cross-site scripting XSS vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with drtsformbuildid parameter containing the XSS payload and t paramet...

Cisco Reissues Patches for Critical Bugs in Jabber Video Conferencing Software

Cisco has once again fixed four previously disclosed critical bugs in its Jabber video conferencing and messaging app that were inadequately addressed, leaving its users susceptible to remote attacks. The vulnerabilities, if successfully exploited, could allow an authenticated, remote attacker to...