Exploit-Medium-CVE-2021-41184

Exploit-Medium-CVE-2021-41184 Exploit Medium CVE-2021-41184 XSS in the of option of the .position util 1. jQuery ui 버전 v1.12.1 취약 1.1 https://www.website.com/js/jquery/jquery-ui-1.12.1/jquery-ui.min.js ------------------------------------------------개념...

Thruk-CVE-2023-34096

Thruk-CVE-2023-34096 Thruk Monitoring Web Interface 버전 = v3.06은 CVE-2023-34096 Path Traversal에 취약합니다. 현재 익스플로잇은 Python 3로 작성되었으며, 이 취약점을 이용하여 여러 Thruk 공통 폴더 및 일부 Linux 폴더에 PoC 파일을 업로드합니다. CVSS CNA GitHub, Inc.는 이 발견에 대해 CVSS 3.1 점수 6.5 Medium을 부여했습니다. NIST NVD 확인...

CVE-2026-34835-Black-box-Analysis

このリポジトリは、外部ペネトレーションテスターの視点からCVE-2026-34835のブラックボックスセキュリティ分析を提供します。 目的は脆弱性のリバースエンジニアリングではなく、許可された評価中にセキュリティ評価者がどのように識別、検証、影響評価を実施できるかを文書化することです。 CVE-2026-34835（Rack Host Header Bypass）のブラックボックス分析 CVE-2026-34835 （中程度の深刻度のバリデーションバイパス脆弱性）に関する動的アプリケーションセキュリティテスト（DAST）の観点からの分析です。...

CVE-2023-29489

CVE-2023-29489 보안 취약점은 CVECommon Vulnerabilities and Exposures 시스템에 등록되어 있습니다. 특히, 이 취약점은 널리 사용되는 호스팅 관리 소프트웨어인 cPanel과 관련이 있습니다. 이 결함은 특수하게 조작된 요청을 통해 XSSCross-Site Scripting 공격을 가능하게 합니다. CVE-2023-29489 세부 정보 이 취약점은 공격자가 cPanel 인터페이스로 전송된 특수하게 조작된 요청을 통해 사용자의 브라우저 💻에서 악성 JavaScript 코드를 실행할 수 있게...

CVE-2023-37189

CVE-2023-37189 — Issabel PBX 4.0.0-6 저장형 교차 사이트 스크립팅 XSS 개요 필드| 세부 정보 ---|--- CVE ID| CVE-2023-37189 취약점| 저장형 교차 사이트 스크립팅 XSS 영향받는 제품| Issabel PBX 4.0.0-6 영향받는 URL| index.php?menu=billingrates 취약한 필드| 새 요금 만들기 모듈의 Name 및 Prefix 필드 심각도| Medium CVSS 3.1 Base Score: 6.1 —...

CVE-2023-37190

CVE-2023-37190 — Issabel-PBX 4.0.0-6: 保存型クロスサイトスクリプティング XSS 📋 概要 項目| 詳細 ---|--- CVE ID| CVE-2023-37190 脆弱性| 保存型クロスサイトスクリプティング XSS 影響を受ける製品| Issabel-PBX 影響を受けるバージョン| 4.0.0-6 深刻度| 中 CVSS v3.1 スコア: 5.4 発見者| Sahil Ojha 開示日| 2023年7月7日 ベンダー| Issabel ソースコード| IssabelFoundation/issabelPBX テスト環境| Windows 📝...

Guten Free Options - Cross Site Scripting

Guten Free Options WordPress plugin = 0.9.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click malicious link. id: CVE-2024-13492 info: name: Guten Free...

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

WordPress iQ Block Country <=1.2.11 - Cross-Site Scripting

WordPress iQ Block Country plugin 1.2.11 and prior contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...

BestWebSoft's Twitter < 2.55 - Cross-Site Scripting

The twitter-plugin plugin before 2.55 for WordPress has XSS. id: CVE-2017-18505 info: name: BestWebSoft's Twitter 2.55 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The twitter-plugin plugin before 2.55 for WordPress has XSS. impact: | Authenticated attackers can...

Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting

The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. id: CVE-2017-18492 info: name: Contact Form to DB by BestWebSoft 1.5.7 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The contact-form-to-db plugin before 1.5.7 for WordPress has multip...

SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting

The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. id: CVE-2017-18518 info: name: SMTP by BestWebSoft 1.1.0 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. impact: |...

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. id: CVE-2017-17059 info: name: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress...

WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect

WordPress WebP Converter for Media 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an open redirect issue. id: CVE-2021-25074 info: name: WordPress WebP Converter for Media 4.0.3 - Unauthenticated Open Redirect author:...

WordPress CTHthemes - Cross-Site Scripting

WordPress CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes contain reflected cross-site scripting vulnerabilities via a search query. id: CVE-2019-20210 info: name: WordPress CTHthemes - Cross-Site Scripting author: edoardottt severity: medium description: |...

phpMyAdmin <4.8.5 - Local File Inclusion

phpMyAdmin before 4.8.5 is susceptible to local file inclusion. When the AllowArbitraryServer configuration setting is set to true, an attacker can read, with the use of a rogue MySQL server, any file on the server that the web server's user can access. This is related to the mysql.allowlocalinfi...

Backdrop CMS version 1.23.0 - Cross Site Scripting (Stored)

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content. id: CVE-2022-42096 info: name: Backdrop CMS version 1.23.0 - Cross Site Scripting Stored author: theamanrawat severity: medium description: | Backdrop CMS version 1.23.0 was...

Duplicator < 1.4.7.1 - Information Disclosure

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. id: CVE-2022-2552 info: name: Duplicator 1.4.7.1 - Information Disclosure author:...

osTicket < 1.10.2 - Cross-Site Scripting

Cross-site scripting XSS vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter. id: CVE-2018-7196 info: name: osTicket 1.10.2 - Cross-Site Scripting author: ritikchaddha severity: medium...

Dash Framework - Cross-site Scripting

Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting XSS via href attribute in anchor tags. This template tests for javascript:alert payload injection. id: CVE-2024-21485 info: name: Dash Framework - Cross-site Scripting author: Lee Changhyuneeche severity: medium...