CVE-2023-37636

A stored cross-site scripting XSS vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket...

PT-2023-26053 · Unknown · Uvdesk Community Skeleton

Name of the Vulnerable Software and Affected Versions: UVDesk Community Skeleton version 1.1.1 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket. This enables...

Uvdesk Cross-Site Scripting Vulnerability

Uvdesk is a complete ticket support system open source by Uvdesk India. A security vulnerability exists in Uvdesk v1.1.1. An attacker exploits this vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload into the Message field when creating a ticket...

CVE-2023-37636: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Message field when creating a ticket...

CVE-2023-41575

Multiple stored cross-site scripting XSS vulnerabilities in /bbdms/sign-up.php of Blood Bank & Donor Management v2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Full Name, Message, or Address parameters...

CVE-2023-41575

Multiple stored cross-site scripting XSS vulnerabilities in /bbdms/sign-up.php of Blood Bank & Donor Management v2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Full Name, Message, or Address parameters...

CVE-2020-23647: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the message field on the submit new ticket form...

CVE-2023-27857

In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a...

CVE-2021-33352: Unrestricted Upload of File with Dangerous Type

An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via a phar file upload in the ticket message field...

CVE-2021-33351: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 allows attackers to escalte privileges via a crafted payload in the ticket message field...

GHSA-RQ2W-37H9-VG94 Apache Tomcat improperly escapes input from JsonErrorReportValve

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

Stored XSS in FAQ comments

Description Stored XSS in FAQ comments by any visitor or anonymous user that alerted in admin panel in comments page also it stored in the FAQ page itself via injecting XSS payload in "Name " and "Message" input fields . Proof of Concept...

CVE-2022-2908

A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit messag...

Design/Logic Flaw

A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit messag...

CVE-2022-2908: Inefficient Regular Expression Complexity

A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit messag...

CVE-2022-37137

PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting XSS during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the vi...

PT-2022-23831 · Paymoney · Paymoney

Name of the Vulnerable Software and Affected Versions: PayMoney version 3.3 Description: The issue is related to Stored Cross-Site Scripting XSS that occurs during the process of replying to a ticket. This can be achieved by injecting a specially crafted payload into the "Message" field using the...

PrestaShop XSS Vulnerability

PrestaShop before 1.5.2.0 allows XSS via the object data='data:text/html substring in the message field...

GHSA-J33M-2537-86JM PrestaShop XSS Vulnerability

PrestaShop before 1.5.2.0 allows XSS via the object data='data:text/html substring in the message field...

PrestaShop 跨站脚本漏洞

Prestashop is a set of open source e-commerce solutions from the United States Prestashop. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop that stems from PrestaShop before 1.5.2 that allows XSS via the...