CVE-2022-37140: Unrestricted Upload of File with Dangerous Type

PayMoney 3.3 is vulnerable to Client Side Remote Code Execution RCE. The vulnerability exists on the reply ticket function and upload the malicious file. A calculator will open when the victim who download the file open the RTF file...

PT-2022-23835 · Paymoney · Paymoney

Name of the Vulnerable Software and Affected Versions: PayMoney version 3.3 Description: The issue is related to Client Side Remote Code Execution RCE and exists in the reply ticket function, where uploading a malicious file can lead to execution of remote code. When a victim downloads and opens...

CVE-2022-37137: Improper Neutralization of Input During Web Page Generation

PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting XSS during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the vi...

CVE-2022-34991

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

CVE-2022-34991

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

CVE-2022-34991

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

Cross site scripting

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

CVE-2022-34991

CVE-2022-34991 affects Paymoney v3.3 with multiple reflected XSS vulnerabilities in the first_name and last_name parameters. The NVD entry lists CVSS 3.1 base metrics: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (base 5.4, MEDIUM). The connected records corroborate XSS but do not provide a specific patch...

CVE-2022-34991

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

Techvillage Paymoney 跨站脚本漏洞

Techvillage Paymoney is a secure online payment gateway from Techvillage Bangladesh. A security vulnerability exists in Techvillage Paymoney v3.3, which stems from a security issue with the parameters firstname and lastname in Users, which can be exploited by an attacker to hijack an XSRF-Token...

CVE-2022-34991: Improper Neutralization of Input During Web Page Generation

Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting XSS vulnerabilities via the firstname and lastname parameters...

Paymoney 3.3 Cross Site Scripting Vulnerability

Title: paymoney-3.3 XSS-Reflected Author: nu11secur1ty Vendor: https://paymoney.techvill.org/ Software: paymoney-3.3 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/paymoney/2022/paymoney-3.3 Description: The parameters firstname and lastname in Users are vulnerable...

Paymoney 3.3 Cross Site Scripting

Title: paymoney-3.3 XSS-Reflected Author: nu11secur1ty Date: 07.02.2022 Vendor: https://paymoney.techvill.org/ Software: paymoney-3.3 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/paymoney/2022/paymoney-3.3 Description: The parameters firstname and lastname in User...