69 matches found
CVE-2024-50677
CVE-2024-50677 | OroPlatform CMS v5.1 中的两次点击反射型XSS漏洞 本仓库提供了CVE-2024-50677的概念验证 免责声明： 此代码是该漏洞的概念验证。我不会对任何使用此利用程序的行为负责。 描述： CVE-2024-50677 指的是 OroPlatform CMS v5.1 默认配置中存在的一个两次点击反射型XSS漏洞，具体演示平台可见：https://github.com/oroinc/docker-demo 该漏洞存在于应用程序对搜索功能用户输入的控制方式中。如果用户点击网页界面中包含JavaScript查询（例如）的搜索栏 alert...
CVE-2023-45824
OroPlatform is a PHP Business Application Platform BAP. A logged in user can access page state data of pinned pages of other users by pageId hash. This vulnerability is fixed in 5.1.4...
CVE-2021-41236
OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview ...
EUVD-2024-1018
Malicious code in bioql PyPI...
EUVD-2024-1012
Malicious code in bioql PyPI...
EUVD-2023-2940
Malicious code in bioql PyPI...
EUVD-2023-3058
Malicious code in bioql PyPI...
EUVD-2022-0678
Malicious code in bioql PyPI...
CVE-2024-50677
A cross-site scripting XSS vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...
CVE-2023-32062
OroPlatform is a package that assists system and user calendar management. Back-office users can access information from any system calendar event, bypassing ACL security restrictions due to insufficient security checks. This vulnerability has been patched in version 5.1.1...
CVE-2022-41951
OroPlatform is a PHP Business Application Platform BAP designed to make development of custom business applications easier and faster. Path Traversal is possible in Oro\Bundle\GaufretteBundle\FileManager::getTemporaryFileName. With this method, an attacker can pass the path to a non-existent file...
CVE-2024-50677
A cross-site scripting XSS vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...
CVE-2024-50677
A cross-site scripting XSS vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...
OroPlatform 安全漏洞
OroPlatform is an Oro open source PHP Business Application Platform BAP designed to make custom business application development easier and faster. A security vulnerability exists in OroPlatform version v5.1, which stems from vulnerability to cross-site scripting attacks, where an attacker can...
CVE-2024-50677
A cross-site scripting XSS vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...
PT-2024-34389 · Oro · Oroplatform Cms
Name of the Vulnerable Software and Affected Versions: OroPlatform CMS version 5.1 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter. This enables attackers to potentially manipulate...
CVE-2024-50677
OroPlatform CMS v5.1 is vulnerable to a two-click reflected XSS vulnerability due to improper neutralization of user input in the Search parameter. An attacker can craft a malicious link containing a JavaScript payload; if a victim clicks the link and subsequently interacts with the search bar, t...
CVE-2024-50677: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...
