Cross-site Scripting (XSS)

gwtupload-samples is vulnerable to cross-site scripting XSS. The attack is possible because it allows the attacker to input malicious file names using the upload functionality, leading to an execution of malicious script when the filename is processed...

Cross-site Scripting (XSS)

dolibarr is vulnerable to cross-site scripting XSS. The attack exists because it does not properly HTML encoded to sanitize $SERVER"HTTPREFERER" arguments, allowing an attacker to inject and execute malicious script...

Information disclosure

A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information...

Magento cross-site scripting vulnerability (CNVD-2020-04821)

Magento is an open source e-commerce framework. Magento suffers from a stored cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when malicious data is view...

CVE-2020-3925

A Remote Code ExecutionRCE vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts...

IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting

Title: IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting Date: 2020-01-27 Author: Lutfu Mert Ceylan Vendor Homepage: www.icewarp.com Tested on: Windows 10 Versions: 11.4.4.1 and before Vulnerable Parameter: "color" Get Method Google Dork: inurl:/webmail/ intext:Powered by IceWarp Server...

This Week in Security News: Over 2,000 WordPress Accounts Compromised and Facebook to Pay $550M to Settle Class Action Case Over Facial Recognition

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, over two thousand WordPress sites were compromised using a malicious script that redirects visitors to scam websites. Also, read about how...

Cross-site Scripting (XSS)

ratpack-core is susceptible to cross-site scripting XSS. It does not sanitize the user input rendered as an exception message in the development error handler, allowing an attacker to inject malicious script via the message.The library is vulnerable only through the development mode's error handl...

Cross-site Scripting (XSS)

nifi-web-api is vulnerable to cross-site scripting XSS. It does not handle error response properly, allowing an unauthenticated user when using the application with Firefox to inject malicious script via UI through action. Note: this vulnerability does occur in other browsers...

Cross-Site Scripting (XSS)

wordpress is vulnerable to cross-site scripting XSS. An attacker can inject malicious script via the function parameters from the function wptargetedlinkrel...

XSS vulnerability in the frontend of Angel School's training website system

Angel school training website system is an open source website management system. Angel School Training Website System has an XSS vulnerability in the front-end that can be exploited by attackers to execute malicious script code...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability (CNVD-2020-13687)

Open-Xchange AppSuite is a set of Web-based cloud desktop environments from the US-based Open-Xchange. Open-Xchange AppSuite suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive...

F5 Networks BIG-IP : Bootstrap vulnerability (K24383845)

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. CVE-2019-8331 Impact An attacker can inject a malicious script into a client browser. Additionally, an attacker can trick auser into running malicious code. C Tenable, Inc. The...

TP-Link Archer Router Unauthenticated Access Vulnerability

TP-Link Archer are a wireless router from China's P&L TP-Link. The TP-Link Archer router has an unauthenticated access vulnerability that can be exploited by an attacker to reset the administrator password by constructing a malicious attack script...

CVE-2019-12311

Sandline Centraleyezer On Premises allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template, the script is loaded...

WiKID Systems 2FA Enterprise Server Cross-Site Scripting Vulnerability (CNVD-2019-43367)

WiKID Systems 2FA Enterprise Server is a two-factor authentication server from WiKID Systems, USA. A cross-site scripting vulnerability exists in WiKID Systems 2FA Enterprise Server, which can be exploited by an attacker to inject malicious script or HTML code, which can be used to obtain sensiti...

Node.js third-party modules: Stored XSS (Hexo-admin plugin)

I would like to report Stored XSS in Hexo-admin It allows The Post editor functionality in the hexo-admin plugin 3.9.0 for Node.js is vulnerable to stored XSS via the content of a post. Module module name: Hexo-admin version: 3.9.0 npm page: https://www.npmjs.com/package/hexo-admin Module...

Cisco Unified Communications Manager WEB Interface Cross-Site Scripting Vulnerability

Cisco Unified Communications Manager is a unified communications solution. A cross-site scripting vulnerability exists in the Cisco Unified Communications Manager WEB interface, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used t...

Cross-Site Scripting (XSS)

jspwiki-war is vulnerable to cross-site scripting XSS. The remember parameter in preview.jsp was not handled properly to escape malicious script injection, allowing to trigger the attack through it...

Cross-Site Scripting (XSS)

padrino-contrib is vulnerable to cross-site scripting XSS. The caption parameter in the function sethome of breadcrumbs.rb is not escaped properly to prevent injection of malicious script through it, allowing an attacker to steal session tokens or perform unwanted actions on behalf of the user...