PT-2020-15004

Name of the Vulnerable Software and Affected Versions MultiUx version 3.1.12.0 Description A post-authenticated stored XSS issue was discovered, allowing potential exploitation via the "LastName" field in the /multiux/SaveMailbox API endpoint. Recommendations For MultiUx version 3.1.12.0, conside...

PT-2020-14523

Name of the Vulnerable Software and Affected Versions Victor CMS through 2019-02-28 Description The issue allows for XSS attacks via the register.php user firstname or user lastname field. Recommendations For Victor CMS through 2019-02-28, consider disabling the register.php page or restricting...

PT-2020-14079 · Global Radar · Global Radar Bsa Radar

Name of the Vulnerable Software and Affected Versions: Global RADAR BSA Radar versions 1.6.7234.24750 and earlier Description: The issue concerns stored cross-site scripting XSS via the Update User Profile feature. Specifically, the Firstname and Lastname parameters are vulnerable. Recommendation...

PT-2020-13534

Name of the Vulnerable Software and Affected Versions Victor CMS version 1.0 Description The issue is related to Persistent XSS in the "admin/users.php?source=add user" endpoint via the user name, user firstname, or user lastname parameters. Recommendations For Victor CMS version 1.0, as a...

CVE-2020-14943: Improper Neutralization of Input During Web Page Generation

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

Mail.ru: HTTP-Response-Splitting leads to information disclosure (email, firstname, lastname) at https://tz.mail.ru

CRLF injection via GET paramaters in tz.mail.ru Clientside vulnerabilities in tz.mail.ru is not currently covered by Bug Bounty program...

osTicket 1.12 Cross Site Scripting

Exploit Title: osTicket-v1.12 Stored XSS Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiyer Category: webapps CVE: CVE-2019-14750 1. Description An issue was...

CVE-2019-14750

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

CVE-2019-14750: Improper Neutralization of Input During Web Page Generation

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

PT-2019-5952

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.10.7 osTicket versions 1.12.x prior to 1.12.1 Description The issue is related to a lack of input sanitization in the firstname and lastname fields, allowing for stored XSS attacks. This can lead to the execution o...

CVE-2019-14331

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

CVE-2019-14330

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

CVE-2019-14331: Improper Neutralization of Input During Web Page Generation

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

PT-2019-13613

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.6 Description An issue exists due to the lack of filtration of user-supplied data in the Create User function, allowing stored XSS. A malicious attacker can modify the firstName and lastName fields to contain...

CVE-2019-14330: Improper Neutralization of Input During Web Page Generation

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

PT-2019-13612

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.6 Description A stored XSS issue exists due to the lack of filtration of user-supplied data in Create Case. An attacker can modify the firstName and lastName to contain JavaScript code. Recommendations For version...

PT-2019-9285

Name of the Vulnerable Software and Affected Versions Creatiwity wityCMS version 0.6.2 Description A search for user discovery injection issue exists, allowing unfiltered input parameters. Specifically, the issue is accessible via the "Utilisateur" menu, affecting parameters such as Nickname,...

PHP Scripts Mall Entrepreneur B2B Script Cross-Site Scripting Vulnerability

PHP Scripts Mall Entrepreneur B2B Script is a suite of B2B e-commerce platforms from PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall Entrepreneur B2B Script version 3.0.6, which can be exploited by a remote attacker to inject arbitrary web script or HTML vi...

PT-2018-15266

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Entrepreneur B2B Script version 3.0.6 Description The issue allows for Stored XSS attacks through certain fields in the Account Settings, such as FirstName and LastName. This is similar to a previously identified issue...

CVE-2018-20138: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541...