5516 matches found
PT-2024-34338
Name of the Vulnerable Software and Affected Versions: WPDeveloper Typing Text versions 1.2.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...
PT-2024-26729
Name of the Vulnerable Software and Affected Versions D'arteweb DImage 360 versions n/a through 2.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in D'arteweb DImage 360...
PT-2024-37438
Name of the Vulnerable Software and Affected Versions: LG Electronics SuperSign CMS versions 4.1.3 through 4.3.0 Description: The issue affects the LG Electronics SuperSign CMS, allowing for Reflected XSS due to improper neutralization of input during web page generation. Recommendations: For...
CVE-2024-6177: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before 4.3.1...
PT-2024-37437
Name of the Vulnerable Software and Affected Versions: LG Electronics SuperSign CMS versions 4.1.3 through 4.3.0 Description: The issue affects LG Electronics SuperSign CMS, allowing for Reflected XSS due to improper neutralization of input during web page generation. Recommendations: For version...
CVE-2024-36397
CVE-2024-36397 affects Vantiva MediaAccess DGA2232 v19.4. The issue is CWE-79 (Cross-site Scripting) caused by improper neutralization of input during web page generation in the affected software. Reported metrics place the severity at CVSS v3.1 base score 6.1 (MEDIUM) with network attack vector,...
CVE-2024-2218: Improper Neutralization of Input During Web Page Generation
The LuckyWP Table of Contents WordPress plugin through 2.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-36395 Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...
SQL Injection
org.apache.submarine: submarine-server-core is vulnerable to SQL Injection. The vulnerability is due to improper neutralization of special elements used in an SQL command, allowing attackers to manipulate queries and potentially gain unauthorized access to the server's database...
CVE-2024-36263: Improper Neutralization of Special Elements used in an SQL Command
UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: all versions. As this project is retired, we do not plan to release a version that fixes thi...
Apache Submarine SQL Injection Vulnerability
Apache Submarine is a cloud-native machine learning platform from the Apache USA Foundation. An SQL injection vulnerability exists in Apache Submarine Server Core, which stems from improper neutralization of the particular element used...
CVE-2024-37177: Improper Neutralization of Input During Web Page Generation
SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause significant impact to confidentiality and...
CVE-2024-34686: Improper Neutralization of Input During Web Page Generation
Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicious script. When a victim clicks on this link, the script will be executed in the victim's browser giving the attacker the ability to access and/or modify...
WordPress plugin YITH WooCommerce Product Add-Ons Injection Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An injection...
CVE-2024-35678
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in BestWebSoft Contact Form to DB by BestWebSoft.This issue affects Contact Form to DB by BestWebSoft: from n/a through 1.7.2...
CVE-2024-35678
CVE-2024-35678 is an authenticated SQL injection in the WordPress plugin Contact Form to DB by BestWebSoft — Messages Database Plugin for WordPress, affecting
CVE-2024-35701
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.13...
CVE-2024-35702
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Jewel Theme Master Addons for Elementor allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through 2.0.6.0...