SourceCodester College Website Management System SQL Injection Vulnerability

SourceCodester College Website Management System is an application of SourceCodester, Inc. SourceCodester College Website Management System version 1.0 is vulnerable to SQL injection, which originates from the lack of user-supplied data and output data in the id parameter of...

Jenkins Tests Selector Plugin跨站脚本漏洞

Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A cross-site scripting vulnerability exists in Jenkins Tests Selector Plugin 1.3.3 and earlier versions, which stems from an unescaped...

SourceCodester Microfinance Management System跨站脚本漏洞

SourceCodester Microfinance Management System is an application of SourceCodester, Inc. A cross-site scripting vulnerability exists in SourceCodester Microfinance Management System version 1.0, which stems from The program lacks data validation filters for user-supplied data and output, which can...

GHSA-QGPV-86R3-87FH Cross-site Scripting in Parsedown

Parsedown version prior to 1.7.0 contains a Cross Site Scripting XSS vulnerability in setMarkupEscaped for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST...

CVE-2022-24131

CVE-2022-24131 affects DouPHP v1.6 Release 20220121. The issue is a Cross Site Scripting (XSS) vulnerability in the backend via /admin/login.php that can lead to JavaScript code execution. Exploitation details, affected versions beyond the stated release, and remediation steps are not provided in...

GHSA-P2J7-6G9H-32XH Cross site scripting in Shopizer

A Stored Cross Site Scripting XSS vulnerability exists in Shopizer versions v2.0.2 through v2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code...

WordPress Mapping Multiple URLs Redirect Same Page plugin Cross Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in WordPress...

WordPress Pz-LinkCard plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the...

PT-2022-16484

Name of the Vulnerable Software and Affected Versions DouPHP version 1.6 Release 20220121 Description The issue affects the background of DouPHP through the "/admin/login.php" API endpoint, allowing for Cross Site Scripting XSS attacks, which can lead to JavaScript code execution. Recommendations...

CVE-2022-24131: Improper Neutralization of Input During Web Page Generation

DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting XSS through /admin/login.php in the background, which will lead to JavaScript code execution...

Royale Event Management System 1.0 Cross Site Scripting

Exploit Title: Royale Event Management System 1.0 - Cross-site Scripting Stored unauthenticated Date: 17/03/2022 Exploit Author: Mr Empy Software Link: https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html Version: 1.0 Tested on: Linux Title:...

Parsedown Class-Name Injection

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

One Church Management System 1.0 Cross Site Scripting

Exploit Title: One Church Management System 1.0 - Multiple Cross-site Scripting Date: 17/03/2022 Exploit Author: Mr Empy Software Link: https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html Version: 1.0 Tested on: Linux Title: ================ One...

GHSA-QF2G-Q4MC-W7RR Cross-site Scripting in Fork CMS

Fork CMS prior to 5.11.1 is vulnerable to stored cross-site scripting. When uploading a new module, the description of the module can contain JavaScript code. The JavaScript code may be executed after uploading the new module and looking at the Details page...

Money Transfer Management System Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Money Transfer Management System version 1.0, a money transfer management system. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute...

OTRS cross-site scripting vulnerability (CNVD-2022-29578)

OTRS is an application from the German company OTRS. A service management software. A cross-site scripting vulnerability exists in OTRS, which stems from the translator's lack of filtering and escaping for a small number of translatable strings, and can be exploited to execute JavaScript code by...

Security Bulletin: IBM InfoSphere Information Server may be vulnerable to various cross-site injection attacks CVE-2019-4727

Summary Potential cross-site injection vulnerabilities were addressed in IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2019-4727 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScrip...

CKEditor 4.x < 4.18.0 Multiple Vulnerabilities - Windows

CKEditor is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CKEditor 4.x < 4.18.0 Multiple Vulnerabilities - Linux

CKEditor is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Code injection in accesslog

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If attacker-controlled user input is given to the format option of the package's exported constructor function, it is possible for an attacker to...