CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2019-17495

A Cascading Style Sheets CSS injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite RPO technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows th...

CVE-2018-20370

SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend...

CVE-2019-15318

The yikes-inc-easy-mailchimp-extender plugin before 6.5.3 for WordPress has code injection via the admin input field...

CVE-2024-55651

CVE-2024-55651 pertains to i-Educar (version 2.9) where the application fails to validate and sanitize input in the user type field, causing a stored cross-site scripting (XSS) vulnerability. The root cause is improper input handling of the Tipo de Usuário field, which could allow an attacker to ...

CVE-2024-55651

i-Educar is free, fully online school management software. Version 2.9 of the application fails to properly validate and sanitize user supplied input, leading to a stored cross-site scripting vulnerability that resides within the user type Tipo de Usuário input field. Through this attacker vector...

Webmin < 2.110 Cross-Site Scripting

According to its self-reported version, the Webmin install hosted on the remote host is prior to 2.110. It is, therefore, affected by a Cross Site Scripting XSS vulnerability in the 'Execute cron job as' tab Input field CVE-2023-52046. Note that the scanner has not tested for these issues but has...

CVE-2024-6986 Cross-site Scripting (XSS) in parisneo/lollms-webui

A Cross-site Scripting XSS vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of the 'v-html' directive, which inserts the content of the 'fulltemplate' variable directly as HTML. This allows an attacker to execute maliciou...

Teachers Record Management System 2.1 Cross Site Scripting Vulnerability

Exploit Title: Teachers Record Management System v2.1 | Unauthenticated Cross-Site Scripting XSS Exploit Author: Mehmet Can Kadıoğlu a.k.a mao7un Vendor: https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/ Demo Site:...

CVE-2022-1718

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service...

CVE-2022-36323

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell...

CVE-2024-29184

FreeScout is a self-hosted help desk and shared mailbox. A Stored Cross-Site Scripting XSS vulnerability has been identified within the Signature Input Field of the FreeScout Application prior to version 1.8.128. Stored XSS occurs when user input is not properly sanitized and is stored on the...

CVE-2024-57329: Improper Neutralization of Input During Web Page Generation

HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaScript payloads...

HortusFox 跨站脚本漏洞

HortusFox is a free and open source self-hosted plant manager system from HortusFox, Inc. A cross-site scripting vulnerability exists in HortusFox version 3.9 that stems from a name input field that is not cleaned up or escapes user input, allowing an attacker to inject and execute arbitrary...

The vulnerability of SpagoBI’s web interface for automating business processes allows a perpetrator to execute arbitrary code.

The vulnerability of SpagoBI’s web interface for automating business processes is related to the failure to take measures to neutralize special elements used in the command input field. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by injecting a specially craft...

Unspecified Vulnerability in IBM Cognos Controller

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and the creation and management of financial reports. A security vulnerability exists in IBM Cognos Controll...

CVE-2024-25036

IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user with local access to bypass security allowing users to circumvent restrictions imposed on input fields...

IBM Cognos Controller 安全漏洞

IBM Cognos Controller is a suite of business intelligence and planning solutions from International Business Machines IBM. The product features process automation, financial audit control, and the creation and management of financial reports. A security vulnerability exists in IBM Cognos Controll...

CVE-2024-25036: Authentication Bypass Using an Alternate Path or Channel

IBM Cognos Controller 11.0.0 and 11.0.1 could allow an authenticated user with local access to bypass security allowing users to circumvent restrictions imposed on input fields...

CVE-2024-51209

Cross-Site Scripting XSS vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML via the search input field parameter to admin search invoice page and client search invoice page...