1070 matches found
PT-2021-11277
Name of the Vulnerable Software and Affected Versions: 2sic 2sxc versions prior to 11.22 Description: An issue was discovered that allows an attacker to craft a malicious URL, exploiting a XSS vulnerability in the sxcver parameter of "dnn/ui.html", which executes a JavaScript payload in a victim'...
Smart Slider 3 < 3.5.0.9 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin did not sanitise the Project Name before outputting it back in the page, leading to a Stored Cross-Site Scripting issue. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may...
CVE-2020-26885: Improper Neutralization of Input During Web Page Generation
An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a malicious URL that executes a JavaScript payload in a victim's browser...
WP Config File Editor <= 1.7.1 - Authenticated Stored Cross-Site Scripting (XSS)
The WP Config File Editor WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting XSS vulnerability. By default, only administrator users could access the affected functionality, limiting the exploitability of the vulnerability. However, some WordPress admins may allow lesse...
Cross-site Scripting (XSS) - Stored in changeweb/unifiedtransform
βοΈ Description Stored Cross Site Scripting in the message/all.blade.php. π΅οΈββοΈ Proof of Concept As a teacher, click on "My Courses" and then "message students". CKEditor hides the underlying where we can add tag or capture the request in a proxy like burpsuite and edit the HTTP POST request. Select...
CVE-2020-22428
SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting XSS via a directory name entered by an admin containing a JavaScript payload...
CVE-2020-22428
SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting XSS via a directory name entered by an admin containing a JavaScript payload...
Cross site scripting
SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting XSS via a directory name entered by an admin containing a JavaScript payload...
CVE-2020-22428
SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting XSS via a directory name entered by an admin containing a JavaScript payload...
PT-2021-10765
Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U versions prior to 15.1.6 Hotfix 3 Description The issue is related to Cross Site Scripting XSS via a directory name containing a JavaScript payload. This payload can be entered by an admin, potentially leading to exploitation...
CVE-2020-22428: Improper Neutralization of Input During Web Page Generation
SolarWinds Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting XSS via a directory name entered by an admin containing a JavaScript payload...
SolarWinds Serv-U FTP Server θ·¨η«θζ¬ζΌζ΄
SolarWinds Serv-U FTP Server is a suite of FTP and MFT file transfer software from the U.S. company SolarWinds. A cross-site scripting vulnerability exists in SolarWinds Serv-U versions prior to 15.1.6, which originates from being subject to cross-site scripting XSS via a directory name containin...
120 Compromised Ad Servers Target Millions of Internet Users
An ongoing malvertising campaign tracked as "Tag Barnakle" has been behind the breach of more than 120 ad servers over the past year to sneakily inject code in an attempt to serve malicious advertisements that redirect users to rogue websites, thus exposing victims to scamware or malware. Unlike...
CVE-2021-30111
A stored XSS vulnerability exists in Web-School ERP V 5.0 via Add Events in the event name and description fields. An attack can inject a JavaScript code that will be stored in the page. If any visitor sees the events, then the payload will be executed...
CVE-2021-29661
Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diagvalues.html Stored XSS via the ITEMLISTVALUESITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page containing it...
CVE-2021-29661
CVE-2021-29661 affects Softing AG OPC Toolbox prior to or including 4.10.1.13035. The issue is a Stored XSS vulnerability in the page /en/diag_values.html, exploitable via the ITEMLISTVALUES##ITEMID parameter which injects JavaScript into the trace file. The payload is triggered whenever an authe...
CVE-2021-29661
Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diagvalues.html Stored XSS via the ITEMLISTVALUESITEMID parameter, resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page containing it...
PT-2021-18390
Name of the Vulnerable Software and Affected Versions Softing AG OPC Toolbox versions prior to 4.10.1.13036 Description The issue allows for Stored XSS via the ITEMLISTVALUESITEMID parameter in the "/en/diag values.html" API endpoint, resulting in JavaScript payload injection into the trace file...
CVE-2021-26715
The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery SSRF vulnerability. The vulnerability arises due to unsafe usage of the logouri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP reque...
CVE-2021-21312
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function Home Management Documents Add, or /front/document.form.php...