13475 matches found
CVE-2021-22874
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the periodpreset parameter...
CVE-2021-22874
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the periodpreset parameter...
CVE-2021-22874
Revive Adserver prior to 5.1.1 is affected by a reflected XSS in userlog-index.php via the period_preset parameter. Public details include a proof-of-concept from HackerOne showing injection on /admin/userlog-index.php with period_preset, enabling script injection and potential cookie theft or re...
CVE-2021-22874: Improper Neutralization of Input During Web Page Generation
Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the periodpreset parameter...
PT-2021-15247
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 5.1.1 Description The issue is related to a reflected XSS vulnerability. It affects the userlog-index.php file via the period preset parameter. Recommendations For versions prior to 5.1.1, update to version...
CVE-2020-19362: Improper Neutralization of Input During Web Page Generation
Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page...
PT-2021-10343
Name of the Vulnerable Software and Affected Versions: Vtiger CRM version 7.2.0 Description: The issue is related to Reflected XSS in Vtiger CRM, where an attacker can perform malicious actions on users who open a maliciously crafted link or third-party web page through the view parameter in...
PT-2021-16506
Name of the Vulnerable Software and Affected Versions: OpenCATS versions 0.9.5-3 and earlier Description: The issue arises from the unsafe deserialization of requests to "index.php?m=activity", leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the...
CVE-2020-23644
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg=XSS to Home/c/ErrorController.php...
CVE-2020-23644
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg=XSS to Home/c/ErrorController.php...
CVE-2020-23643
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr=XSS to Home/c/WechatController.php...
CVE-2020-23644: Improper Neutralization of Input During Web Page Generation
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg=XSS to Home/c/ErrorController.php...
PT-2021-10921
Name of the Vulnerable Software and Affected Versions JIZHICMS version 1.7.1 Description A security issue exists where an attacker can execute arbitrary code. The issue is related to the "/index.php/Error/index?msg=" API endpoint, which is vulnerable to XSS attacks. This endpoint is handled by th...
PT-2021-10920
Name of the Vulnerable Software and Affected Versions JIZHICMS version 1.7.1 Description A security issue exists where an attacker can inject malicious code. The issue is related to the "index.php/Wechat/checkWeixin" API endpoint, specifically with the signature and echostr parameters, where an...
CVE-2020-23643: Improper Neutralization of Input During Web Page Generation
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr=XSS to Home/c/WechatController.php...
CVE-2021-3111: Improper Neutralization of Input During Web Page Generation
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI...
PT-2021-19148
Name of the Vulnerable Software and Affected Versions Concrete5 version 8.5.4 Description The issue allows stored XSS via the name field of a new data object at the "index.php/dashboard/express/entries/view/" URI. This occurs in the Express Entries Dashboard. Recommendations For Concrete5 version...
PT-2021-11575
Name of the Vulnerable Software and Affected Versions: MonoCMS Blog version 1.0 Description: The issue is related to incorrect access control, which can lead to remote arbitrary code execution. Specifically, at monofiles/category.php:27, user input can be saved to category/foldername/index.php,...
Advanced Comment System 1.0 - 'ACS_path' Path Traversal
Exploit Title: Advanced Comment System 1.0 - 'ACSpath' Path Traversal Date: Fri, 11 Dec 2020 Exploit Author: Francisco Javier Santiago Vázquez aka "n0ipr0cs" Vendor Homepage: Advanced Comment System - ACS Version: v1.0 CVE: CVE-2020-35598...
