Hoteldruid 安全漏洞

Hoteldruid is a free and open source hotel management program from Hoteldruid. A security vulnerability exists in Hoteldruid version v3.0.5, which stems from the injection of a specially crafted payload in the commento11 parameter, which could lead to a cross-site scripting attack...

CVE-2024-53568

CVE-2024-53568 describes a stored XSS in Volmarg Personal Management System v1.4.65, via the Image Upload section where an attacker can inject a payload into the tag parameter. Affected component is the Image Upload/tag handling; root cause is input handling in the tag parameter. Impact as per so...

Ivanti Endpoint Manager（EPM） 跨站脚本漏洞

Ivanti Endpoint Manager is an enterprise-grade endpoint management solution, mainly used for centralized management of various types of devices including Windows, MacOS, Linux, iOS/Android mobile devices, etc., to achieve unified configuration, security control and remote operation and maintenanc...

Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS

Exploit Title: Elaine's Realtime CRM Automation 6.18.17 - Reflected XSS Date: 09/2024 Exploit Author: Haythem Arfaoui CBTW Team Vendor Homepage: https://www.elaine.io/ Software Link: https://www.elaine.io/en/products/elaine-marketing-automation/ Version: 6.18.17 and below Tested on: Windows, Linu...

CVE-2024-55009

A reflected cross-site scripting XSS vulnerability in AutoBib - Bibliographic collection management system 3.1.140 and earlier allows attackers to execute arbitrary Javascript in the context of a victim's browser via injecting a crafted payload into the WCE=topFrame&WCU= parameter...

The vulnerability of the Tittle parameter in the Product Dolibarr module of the system for planning enterprise resources and managing customer relationships allows attackers to carry out XSS attacks.

The vulnerability of the Tittle parameter in the Product Dolibarr module, a system for planning enterprise resources and managing relationships with customers, is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker, operating...

Stored Cross-site Scripting (XSS)

github.com/lf-edge/ekuiper is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to improper input validation in the rule id parameter, allowing an attacker with modification rights to inject a malicious payload that executes in the victim's browser when the rule is modified...

LF Edge eKuiper 跨站脚本漏洞

LF Edge eKuiper is an edge lightweight IoT data analytics software from LF Edge open source. A cross-site scripting vulnerability exists in LF Edge eKuiper versions prior to 2.0.8, which originates from a user with Modify Service privileges being able to inject a cross-site scripting payload into...

CVE-2025-25908

A stored cross-site scripting XSS vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save...

Vue I18n Allows Prototype Pollution in `handleFlatJson`

Vulnerability type: Prototype Pollution Vulnerability Locations: js v9.1 nodemodules/@intlify/message-resolver/index.js v9.2 or later nodemodules/@intlify/vue-i18n-core/index.js Description: The latest version of @intlify/message-resolver 9.1 and @intlify/vue-i18n-core 9.2 or later, previous...

CVE-2025-27597 Vue I18n Prototype Pollution in `handleFlatJson`

Vue I18n is the internationalization plugin for Vue.js. @intlify/message-resolver and @intlify/vue-i18n-core are vulnerable to Prototype Pollution through the entry function: handleFlatJson. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the...

Dreamer CMS Cross-Site Scripting Vulnerability (CNVD-2025-04175)

Dreamer CMS is a dreamer content management system. Dreamer CMS version 4.1.3 suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the editorValue, answer and content parameters in the /admin/archives/edit...

CVE-2025-25818

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at articlesave.php...

CVE-2024-57409

CVE-2024-57409 affects the Cool-Admin-Java project (v1.0) with a vulnerability in the Parameter List module . The issue is a stored XSS that allows an attacker to execute arbitrary web scripts or HTML by injecting a crafted payload into the internet pictures field . Reported details indicate impa...

GHSA-R7JX-5M6M-CPG9 eazy-logger prototype pollution

A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing deni...

CVE-2020-26218

touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0...

CVE-2024-57098

Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter...

CVE-2024-57098

CVE-2024-57098 concerns Moss v0.1.3. The vulnerability is an SQL injection in the order parameter, enabling attackers to inject crafted payloads. The CVSSv3.1 vector (Network, Low/None privileges, No user interaction, Unchanged scope) yields a base score of 9.8 (CRITICAL) with high impact to conf...

CVE-2024-57098

Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter...

CVE-2024-57098

Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter...