The vulnerability of the wloggui interface of the Control Web Panel (CWP) application (formerly CentOS Web Panel) allows a malicious user to escalate their privileges and execute arbitrary commands.

The vulnerability of the wloggui interface of the Control Web Panel CWP application formerly CentOS Web Panel is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary commands...

The vulnerability of the mysql_manager module of the Control Web Panel (CWP) application, which is used for managing servers, as well as the Avast Premium Security antivirus protection, allows a malicious individual to escalate their privileges and execute arbitrary code.

The vulnerability of the mysqlmanager module of the Control Web Panel CWP application, which is used for managing servers, along with the Avast Premium Security antivirus protection, is related to deficiencies in access control within the isolated environment when processing special elements...

GHSA-639H-86HW-QCJQ Decidim has broken access control in templates

Impact The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys...

Improper Access Control

Overview decidim-templates is a This module provides a solution to create templates for different Decidim models, such as Proposals and Questionnaires. Affected versions of this package are vulnerable to Improper Access Control due to the broken access control in the templates module. An attacker...

Decidim has broken access control in templates

Impact The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys...

CVE-2023-43260

Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting XSS vulnerability via the admin panel...

CVE-2023-43260

Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting XSS vulnerability via the admin panel...

CVE-2023-43260

Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting XSS vulnerability via the admin panel...

Cross site scripting

Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting XSS vulnerability via the admin panel...

PT-2023-28748 · Milesight · Milesight Ur32L +3

Name of the Vulnerable Software and Affected Versions: Milesight UR5X, UR32L, UR32, UR35, UR41 versions prior to 35.3.0.7 Description: A cross-site scripting XSS issue was discovered in the admin panel of the affected devices. This issue allows for malicious scripts to be injected into the websit...

CVE-2023-43260

CVE-2023-43260 affects Milesight UR5X, UR32L, UR32, UR35, UR41 prior to version 35.3.0.7 with an XSS vulnerability exploitable via the admin panel. The vulnerability is documented across multiple feeds (NVD/Red Hat/CVE lists) and is mitigated by upgrading to version 35.3.0.7 or later (per PT-2023...

CVE-2023-43260

Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting XSS vulnerability via the admin panel...

CVE-2023-43260

Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting XSS vulnerability via the admin panel...

Milesight Cross-Site Scripting Vulnerability

Milesight is a complete Artificial Intelligence Video Surveillance solution from China's StarZone IOT Milesight. A cross-site scripting vulnerability exists in Ursalink Milesight UR5X, UR32L, UR32, UR35, UR41 , Industrial Cellular Routers prior to v35.3.0.7, which stems from the admin panel being...

Decidim has broken access control in templates

Impact The templates module doesn't enforce the correct permissions, allowing any logged-in user to access to this functionality in the administration panel. An attacker could use this vulnerability to change, create or delete templates of surveys...

CVE-2023-3196

This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administration panel...

CVE-2023-4564

This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel...

Design/Logic Flaw

This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel...

Design/Logic Flaw

This vulnerability could allow an attacker to store a malicious JavaScript payload in the login footer and login page description parameters within the administration panel...

CVE-2023-4564

CVE-2023-4564 affects Canopsis (Capensis) with a stored cross-site scripting (XSS) flaw in the admin panel that allows an attacker to store a malicious JavaScript payload via the broadcast message parameter. The Red Hat, NVD, OSV, and related records consistently describe a stored XSS in the broa...