Google Chrome 103.0.5060.53 Autofill Assistant Universal Cross Site Scripting

Chrome: Universal XSS in Autofill Assistant VULNERABILITY DETAILS From the Autofill Assistant README file1: Autofill Assistant is an execution engine to run user journeys on websites given a set of actions. These actions include clicking on buttons or scrolling to an element. They also provide a...

CVE-2022-40144

A vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service could allow an attacker to bypass the product's login authentication by falsifying request parameters on affected installations...

CVE-2022-37253

Persistent cross-site scripting XSS in Crime Reporting System 1.0 allows a remote attacker to introduce arbitary Javascript via manipulation of an unsanitized POST parameter...

Simple Task Managing System 跨站脚本漏洞

Simple Task Managing System is a simple task management system. Simple Task Managing System suffers from a cross-site scripting vulnerability that stems from its unknown code manipulation of the parameter studentadd resulting in cross-site scripting. The attack method can be initiated remotely an...

CVE-2022-33148

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules...

Guest Management System 跨站脚本漏洞

Guest Management System is a web-based system designed to monitor the records of everyone entering a school or college. The Guest Management System suffers from a cross-site scripting vulnerability that stems from the manipulation of the parameter name in an unknown portion of its myform.php...

Student Information System SQL注入漏洞

Student Information System is a web-based application platform by Carlo Montero, a personal developer. It can help a university or college to manage student information and academic records. A SQL injection vulnerability exists in Student Information System. An attacker can exploit this...

Library Management System 跨站脚本漏洞

Library Management System is a library management system with QR code attendance and automatic library card generation by King Albaracin Individual Developer. A cross-site scripting vulnerability exists in Library Management System, which stems from unknown code in the file /qr/I/ being affected,...

Company Website CMS 代码问题漏洞

Company Website CMS is a company website/CMS by Torrahclef Personal Developer. Company Website CMS is vulnerable to a code issue that originates from an unrestricted upload due to the manipulation of the xfile/ufile parameters by an unknown part of the code in its backend upload logo icon compone...

User can do all actives with other's signature (view, get, create, update, delete,...)

Description I observed that users can view any user's signature by changing their user parameter to other's user parameter. By the same way users can create/delete/update other's signature in create signature function. View/Get other's signature: 1. Login to an account I use account receptionist...

CVE-2022-1561

The CVE-2022-1561 issue concerns Lura and KrakenD-CE before 2.0.2 and KrakenD-EE before 2.0.0 where URL parameters aren’t sanitized, enabling a crafted URL to alter the backend URL defined for a pipe. The vulnerability does not affect KrakenD itself, but the consumed backend may be vulnerable. Re...

CVE-2022-31208

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmdstring URL parameter...

CVE-2022-23173

CVE-2022-23173 describes an IDOR-type flaw in a web application (notably referenced with Priority Software Priority) where an attacker who can access the login/demo UI can alter the prog step parameter from 0 to 1 or higher, thereby gaining access to functions that should be restricted by privile...

SialWeb CMS SQL Injection Vulnerability

SialWeb CMS is a content management system from SialWeb Pakistan. SQL injection vulnerability exists in SialWeb CMS, which can be exploited by attackers to manipulate the parameter Id to cause sql injection...

GHSA-C273-C6VG-4PV5 Publify has Improper Access Controls

A low-privileged user can modify and delete admin articles by changing the value of the articleid parameter prior to 9.2.9...

Improper Access Control - Articles

Description A low-privileged user can modify and delete admin articles just by changing the value of the articleid parameter. Proof of Concept - Step 1 - Authenticated as an unprivileged user, create a New article - Step 2 - Click Edit article - Step 3 - Intercept requests and Save your article -...

GHSA-2Q65-XXG6-3QH5 Apache OpenMeetings vulnerable to parameter manipulation attacks

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas...

Apache OpenMeetings vulnerable to parameter manipulation attacks

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas...

GHSA-3MJP-P938-4329 Apache Tomcat vulnerable to SecurityManager bypass

A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet...

SQL injection in PortalNotes

Description In PortalNotes.php, web server get values parameter as a part of sql query without sanitize, so attacker can be manipulated sql query, which is executed by web server. Proof of Concept POST /rosariosis/Modules.php?value=123 HTTP/1.1 Host: localhost:8080 User-Agent: Mozilla/5.0 Windows...