Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the configoption parameter in admconfigreport.php. An attacker can inject arbitrary web script or HTML by crafting a malicious 'configoption' parameter. Details...

CVE-2021-24949: Improper Neutralization of Special Elements used in an SQL Command

The "WP Search Filters" widget of The Plus Addons for Elementor - Pro WordPress plugin before 5.0.7 does not sanitise and escape the option parameter before using it in a SQL statement, which could lead to SQL injection...

DEBIAN-CVE-2021-22898

curl 7.7 through 7.76.1 suffers from an information disclosure when the -t command line option, known as CURLOPTTELNETOPTIONS in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEWENV variables, libcurl could be made to pass on...

Mikaelbr Node-notifier Operating System Command Injection Vulnerability

Mikaelbr Node-notifier is a Javascript-based codebase for sending rulers for Mac, Windows, and Linux by the individual developer Mikaelbr. A security vulnerability exists in node-notifier versions prior to 9.0.0, which allows an attacker to exploit the vulnerability to run arbitrary commands on a...

Prototype Pollution

chart.js is vulnerable to prototype pollution. The vulnerability exists through the lack of sanitization of the options parameter, allowing an attacker to inject and overwrite arbitrary properties...

Sql injection

SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the productoption parameter...

CVE-2019-9184

SQL injection vulnerability in the J2Store plugin 3.x before 3.3.7 for Joomla! allows remote attackers to execute arbitrary SQL commands via the productoption parameter...

Blat 3.2.14 - Stack Overflow

Vulnerable Product Version: Blat v3.2.14 Link: blat.net 2. Vulnerability Information Impact: Attacker may gain administrative access / can perform a DOS Remotely Exploitable: No Locally Exploitable: May be possible 3. Product Details An open source Windows 32 & 64 bit command line SMTP mailer...

CVE-2009-3440: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the option parameter to the default URI aka the main menu...

CVE-2007-6695

Cross-site scripting XSS vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter...

CVE-2007-6695: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in Drake CMS 0.4.9 allows remote attackers to inject arbitrary web script or HTML via the option parameter...

CVE-2003-1203: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php for Mambo Site Server 4.0.10 allows remote attackers to execute script on other clients via the ?option parameter...