Cross site request forgery (csrf)

The Private Domains extension for MediaWiki through 1.37.2 before 1ad65d4c1c199b375ea80988d99ab51ae068f766 allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains...

CVE-2022-29903

The Private Domains extension for MediaWiki through 1.37.2 before 1ad65d4c1c199b375ea80988d99ab51ae068f766 allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains...

CVE-2022-24864

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...

Design/Logic Flaw

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...

CVE-2022-24864 Malicious Javascript injection in OriginProtocol/origin-website

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...

CVE-2022-25343

An issue was discovered on Olivetti d-COLOR MF3555 2XDS000.002.271 devices. The Web Application is affected by Denial of Service. An unauthenticated attacker, who can send POST requests to the /download/set.cgi page by manipulating the failhtmfile variable, is able to cause interruption of the...

CVE-2022-25344

An XSS issue was discovered on Olivetti d-COLOR MF3555 2XDS000.002.271 devices. The Web Application doesn't properly check parameters, sent in a /dvcset/sysset/set.cgi POST request via the arg01.Hostname field, before saving them on the server. In addition, the JavaScript malicious content is the...

CVE-2022-25344

An XSS issue was discovered on Olivetti d-COLOR MF3555 2XDS000.002.271 devices. The Web Application doesn't properly check parameters, sent in a /dvcset/sysset/set.cgi POST request via the arg01.Hostname field, before saving them on the server. In addition, the JavaScript malicious content is the...

Cross site scripting

An XSS issue was discovered on Olivetti d-COLOR MF3555 2XDS000.002.271 devices. The Web Application doesn't properly check parameters, sent in a /dvcset/sysset/set.cgi POST request via the arg01.Hostname field, before saving them on the server. In addition, the JavaScript malicious content is the...

CVE-2022-25344

An XSS issue was discovered on Olivetti d-COLOR MF3555 2XDS000.002.271 devices. The Web Application doesn't properly check parameters, sent in a /dvcset/sysset/set.cgi POST request via the arg01.Hostname field, before saving them on the server. In addition, the JavaScript malicious content is the...

Origin Protocol 跨站脚本漏洞

Origin Protocol is an ethereum-based platform from US-based Origin that aims to bring irreplaceable tokens NFT and decentralized finance DeFi to the masses. A security vulnerability exists in Origin Protocol that allows an attacker to inject malicious Javascript code into /presale/join via a POST...

Kyocera d-COLOR MF3555 跨站脚本漏洞

Kyocera d-COLOR MF3555 is a color multifunction printer from Kyocera Japan.A cross-site scripting vulnerability exists in the Kyocera d-COLOR MF3555 2XDS000.002.271 device, which stems from a web application not properly checking parameters before saving them to the server, and can be exploited b...

GHSA-5H7W-HMXC-99G5 Cross site scripting in safe-svg

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent mainly XSS, but depending...

CVE-2022-1091

The CVE-2022-1091 issue affects the Safe SVG WordPress plugin prior to version 1.9.10. The sanitisation step can be bypassed by spoofing the content-type in a POST request to upload an SVG file, allowing an attacker to perform XSS (and potentially other XML-related attacks depending on the SVG us...

Presshell - Quick And Dirty Wordpress Command Execution Shell

presshell Quick & dirty Wordpress Command Execution Shell. Execute shell commands on your wordpress server. Uploaded shell will probably be at /wp-content/plugins/shell/shell.php Installation To install the shell, we are assuming you have administrative rights to Wordpress and can install plugins...

The vulnerability of the httpd-demon microprogramming system for TP-Link TL-WPA4220 allows a hacker to execute arbitrary commands.

The vulnerability of the httpd-demon microprogramming system for TP-Link TL-WPA4220 relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending a special...

CVE-2022-1287

A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=saveuser. The manipulation with a POST request leads to privilege escalation. The attack can be initiated remotely and does not requir...

CVE-2022-1287

A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=saveuser. The manipulation with a POST request leads to privilege escalation. The attack can be initiated remotely and does not requir...

School Club Application System 注入漏洞

School Club Application System is a school club application system by Carlo Montero Personal Developer. A security vulnerability exists in School Club Application System version 1.0, which stems from an action on a POST request that results in an escalation of privileges. A remote attacker can us...

SAP Information System Access Control Error Vulnerability

SAP Information System is an information management system from SAP Germany. An Access Control Error vulnerability exists in SAP Information System 1.0 that stems from insufficient program authentication strength and can be exploited by an unauthenticated attacker to create a new administrator...