2336 matches found
ChurchCRM 4.2.0 CSV Injection
Exploit Title: ChurchCRM 4.2.1- CSV/Formula Injection Date: 2020- 10- 24 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://churchcrm.io/ Software Link: https://github.com/ChurchCRM/CRM Version: 4.2.0 Payload: =10+20+cmd|' /C calc'!A0 Tested on: Kali Linux 2020.3 Proof Of Concept: CSV...
CVE-2020-24807
The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...
Input validation
The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...
CVE-2020-24807
The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported...
PT-2020-15839 · Node.Js · Socket.Io-File
Name of the Vulnerable Software and Affected Versions: socket.io-file versions through 2.0.31 Description: The socket.io-file package for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified...
Ozeki NG SMS Gateway Cross-Site Scripting Vulnerability
Ozeki NG SMS Gateway is a powerful, reliable and flexible SMS gateway application. A cross-site scripting vulnerability exists in Ozeki NG SMS Gateway 4.17.6 and earlier versions. The vulnerability can be exploited via the Receiver or Recipient field in the mailbox function, the OZFORMGROUPNAME...
CVE-2020-14024
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the 1 Receiver or Recipient field in the Mailbox feature, 2 OZFORMGROUPNAME field in the Group configuration of addresses, 3 listname field in the Defining address lists configuration, o...
CVE-2020-24198
A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'...
PT-2020-15652 · Sourcecodester · Sourcecodester Stock Management System
Name of the Vulnerable Software and Affected Versions: Sourcecodester Stock Management System version 1.0 Description: A persistent cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the Brand Name. This enables attackers to potentially execute malicious...
CVE-2020-15020
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field...
CVE-2020-15020
An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field...
DBHcms Cross-Site Scripting Vulnerability (CNVD-2020-49085)
DBHcms is a small, free and open source content management system for personal and small business websites. A stored cross-site scripting vulnerability exists in DBHcms 1.2.0. The vulnerability stems from the non-existence of the htmlspecialchars function form 'Name' in dbhcmstypes.php. An attack...
CVE-2020-19880
DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users...
Cross site scripting
DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users...
Cross-Site Scripting (XSS)
Symphony CMS is susceptible to cross-site scripting XSS. Lack of sanitization for the name field to appendSubheading, allowing an attacker to inject malicious script through it...
CVE-2020-13427
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...
FreeBSD : piwigo -- Multible Vulnerabilities (436d7f93-9cf0-11ea-82b8-4c72b94353b5)
Piwigo reports : Piwigo 2.10.1 is affected by stored XSS via the Group Name Field to the grouplist page. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2020 Jacques Vidrine and contributors...
PT-2020-6385 · Phplist · Phplist
Name of the Vulnerable Software and Affected Versions: phplist version 3.5.3 Description: The issue is related to a lack of protection for the web page structure, allowing a remote attacker to perform cross-site scripting attacks. This can be achieved by creating a new username in the login name...
