CVE-2019-18873

FUDForum 3.0.9 is affected by CVE-2019-18873 (and related CVE in sources) via Stored XSS in the User-Agent header, enabling remote code execution. The issue arises in admsession.php and admuser.php, and requires an authenticated user to trigger the attack; when an admin visits the affected area u...

Optergy 2.3.0a - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for hardware platform in category web applications Title: Optergy 2.3.0a - Cross-Site Request Forgery Add Admin Author: LiquidWorm Vendor: https://optergy.com/ Product web page: https://optergy.com/products/ Affected version: history.pushState'', '', '/' input type="hidden" name...

FUDForum 3.0.9 Code Execution / Cross Site Scripting

// Exploit Title : FUDForum 3.0.9 - Stored XSS / Remote Code Execution // Date : 10/26/19 // Exploit Author : liquidsky JMcPeters // Vulnerable Software : FUDForum 3.0.9 // Vendor Homepage : https://sourceforge.net/projects/fudforum/ // Version : 3.0.9 // Software Link :...

PT-2019-4227

Name of the Vulnerable Software and Affected Versions Windows Certificate Dialog affected versions not specified Nvidia Control Panel affected versions not specified Description An elevation of privilege issue exists due to improper enforcement of user privileges. This allows attackers to...

CVE-2019-5694

NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs without validating the path or signature also known as a binary planting or DLL preloading attack, which may lead to denial of service or...

CVE-2019-5694

CVE-2019-5694 affects NVIDIA Windows GPU Display Driver via the NVIDIA Control Panel loading Windows DLLs without path/signature validation (binary planting). Local attacker access required; impact includes denial of service or information disclosure with potential for code execution. From the pr...

CVE-2019-5694

NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs without validating the path or signature also known as a binary planting or DLL preloading attack, which may lead to denial of service or...

Cross site scripting

Cross-site Scripting XSS in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel...

CVE-2011-4629

Cross-site Scripting XSS in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel...

CVE-2011-4629

TYPO3 Cross-site Scripting (CVE-2011-4629) affects TYPO3 core prior to 4.3.12, 4.4.x prior to 4.4.9, and 4.5.x prior to 4.5.4. The issue allows remote attackers to inject script/HTML via the admin panel due to insufficient validation of client-side data in the web application. The vulnerability i...

CVE-2011-4629

Cross-site Scripting XSS in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel...

Parallels Plesk Panel 9.5 Cross Site Scripting

Exploit Title: Parallels Plesk Panel 9.5 Reflected XSS Release Date: 06/11/2019 Author: Cyber Citadel Website: www.cybercitadel.com Vendor: www.plesk.com Versions 9.5 Description A Cross Site Scripting vulnerability occurs when an attacker can inject JavaScript in context of the web application...

CVE-2019-17062

An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrativ...

WordPress YIT Plugin Framework Unauthorized Modification Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.YIT Plugin Framework is one of the YIT plugin frameworks used in it. A security vulnerability exists in the...

CVE-2019-16295

Stored XSS in filemanager2.php in CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.885 exists via the cmdarg parameter. This can be exploited by a local attacker who supplies a crafted filename within a directory visited by the victim...

CVE-2019-16295

Stored XSS in filemanager2.php in CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.885 exists via the cmdarg parameter. This can be exploited by a local attacker who supplies a crafted filename within a directory visited by the victim...

CVE-2019-16251

plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes...

CVE-2019-9758

An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators from security/permissions.view, security/addUsers.view, or wiki/Administration/page.view in the admin panel, leading to privilege escalation...

Control Web Panel Cross-Site Scripting Vulnerability

Control Web Panel is a Linux web hosting control panel. A cross-site scripting vulnerability exists in Control Web Panel version 0.9.8.885, which stems from the lack of proper validation of client-side data by the web application and can be exploited by an attacker to execute client-side code...

ClonOS WEB control panel cross-site scripting vulnerability

ClonOS is an open source platform based on FreeBSD. The platform is mainly used for the creation and management of virtual environments. web control panel is one of the web-based ClonOS control panel. A cross-site scripting vulnerability exists in the index.php file in the ClonOS WEB control pane...