Remote Code Execution (RCE)

jenkins-2-plugins is vulnerable to remote code execution. The vulnerability exists due to a sandbox bypass allowing an attacker to inject maliciously crafted code into the system...

Modern Events Calendar Lite < 6.4.7 - Reflected Cross-Site Scripting

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC On a page where the Total Booking widget is displayed, append the following payload: "...

CVE-2022-25612 WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities in Simple Event Planner WordPress plugin = 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &customeventorganiser, &customorganiseremail, &customorganisercontact...

CVE-2022-24915 ICSA-22-062-01 IPCOMM ipDIO

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. Th...

CVE-2022-22985 ICSA-22-062-01 IPCOMM ipDIO

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the specific web section where the information is displayed. Injection can be done on specific...

CVE-2021-46116

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin.TemplateControllerdoInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code...

20K WordPress Sites Exposed by Insecure Plugin REST-API

More than 20,000 WordPress sites are vulnerable to malicious code injection, phishing scams and more as the result of a high-severity cross-site scripting XSS bug discovered in the WordPress Email Template Designer – WP HTML Mail, a plugin for designing custom emails. The new vulnerability...

Qnap Kazoo Server 跨站脚本漏洞

Qnap Kazoo Server is a server from China Welllink Technology Qnap. QNAP Kazoo Server suffers from a cross-site scripting vulnerability, which can be exploited by attackers to inject malicious code...

KLA12381 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, inject malicious code, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free...

Jetbrains JetBrains TeamCity 跨站脚本漏洞

TeamCity is a Java-based build management and continuous integration server from JetBrains. A stored cross-site scripting vulnerability exists in versions of JetBrains TeamCity prior to 2021.1.2. An attacker can exploit this vulnerability to insert malicious code...

OPENSUSE-SU-2021:1443-1 Security update for salt

This update for salt fixes the following issues: - Support querying for JSON data in external sql pillar. - Exclude the full path of a download URL to prevent injection of malicious code. bsc1190265, CVE-2021-21996 This update was imported from the SUSE:SLE-15-SP2:Update update project...

Remote Code Execution (RCE)

aaptjs is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the cmd user input allowing an attacker to inject maliciously craft code via the exec command in the promistify function...

Mail.ru: Subdomain Takeover

Hi team, Actually team this bug is similar to my previous bug which I submitted-██████ Issue details:- Subdomain takeover vulnerabilities occur when a subdomain subdomain.example.com is pointing to a service e.g. GitHub pages, Heroku, etc. that has been removed or deleted. This allows an attacker...

EyouCMS Cross-Site Scripting Vulnerability (CNVD-2021-82428)

EyouCms is a free and open source enterprise content management system based on the TP5.0 framework that focuses on the needs of enterprise website users. The vulnerability stems from the lack of validation of input data in Eyoucms. An attacker could use this vulnerability to inject malicious cod...

WooCommerce Pricing Plugin Allows Malicious Code-Injection

A pair of security vulnerabilities in the WooCommerce Dynamic Pricing and Discounts plugin from Envato could allow unauthenticated attackers to inject malicious code into websites running unpatched versions. This can result in a variety of attacks, including website redirections to phishing pages...

CVE-2020-36196

A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0...

QNAP QTS XSS Vulnerability (QSA-21-32)

QNAP QTS is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

CVE-2021-22439

Huawei AnyOffice is affected by a deserialization vulnerability in version V200R006C10. The issue allows an attacker to craft a specific request to achieve remote code execution and take control of the device. Root cause is deserialization of untrusted data, with exploitation described as feasibl...

Cross-site Scripting (XSS)

qiita-markdown is vulnerable to cross site scripting. An attacker is able to inject and execute malicious code via a crafted gist link...

Ballerina 访问控制错误漏洞

Ballerina is an open source programming language platform. Ballerina suffers from a security vulnerability that can be exploited by an attacker to replace or modify packages retrieved from BC, allowing malicious code to be injected into the Ballerina executable...