CVE-2020-24860

CVE-2020-24860 affects CMS Made Simple 2.2.14. An authenticated user with access to the Content Manager can edit content and inject a persistent XSS payload into affected text fields, potentially obtaining cookies from every authenticated visitor. The available connected documents confirm the vul...

CVE-2020-24860

CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website...

CVE-2020-14223: Improper Neutralization of Input During Web Page Generation

HCL Digital Experience 8.5, 9.0, 9.5 is susceptible to cross-site scripting XSS. The vulnerability could be employed in a reflected or non-persistent XSS attack...

CVE-2020-24860: Improper Neutralization of Input During Web Page Generation

CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website...

CVE-2020-24861: Improper Neutralization of Input During Web Page Generation

GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page...

CVE-2019-19393: Improper Neutralization of Input During Web Page Generation

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.002 to V3.15.704 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content such as JavaScript or other client-side scripts as the...

PT-2020-15845

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.16 Description The issue concerns a persistent Cross Site Scripting XSS flaw. It occurs through the permalink parameter on the Settings page. The XSS is executed when creating and opening a new page. Recommendations F...

GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting (Authenticated)

Exploit Title: GetSimple CMS 3.3.16 - Persistent Cross-Site Scripting Authenticated Google Dork: - Date: 2020-09-29 Exploit Author: Roel van Beurden Vendor Homepage: http://get-simple.info Software Link: http://get-simple.info/download Version: 3.3.16 Tested on: Linux Ubuntu 18.04 CVE: N/A 1...

Non-persistent XSS in the Storefront in Shopware

Impact Non-persistent XSS in the Storefront Patches We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin:...

GHSA-QVHR-55HG-3QWV Non-persistent XSS in the Storefront in Shopware

Impact Non-persistent XSS in the Storefront Patches We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions you can use the Security Plugin:...

CVE-2020-24924: Improper Neutralization of Input During Web Page Generation

A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...

RAD SecFlow-1v SF_0290_2.3.01.26 Cross Site Scripting

Exploit Title: RAD SecFlow-1v SF02902.3.01.26 - Persistent Cross-Site Scripting Date: 2020-08-31 Exploit Author: Jonatan Schor and Uriel Yochpaz Vendor Homepage: https://www.rad.com/products/secflow-1v-IIoT-Gateway Version: SecFlow-1v os-image SF02902.3.01.26 Tested on: RAD SecFlow-1v CVE : N/A A...

CVE-2020-24198: Improper Neutralization of Input During Web Page Generation

A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'...

CVE-2020-24963: Improper Neutralization of Input During Web Page Generation

An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4...

PT-2020-15870

Name of the Vulnerable Software and Affected Versions Best Support System version v3.0.4 Description An Authenticated Persistent XSS issue was found. Recommendations For version v3.0.4, at the moment, there is no information about a newer version that contains a fix for this issue...

Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting

Exploit Title: Savsoft Quiz Enterprise Version 5.5 - Persistent Cross-Site Scripting Date: 2020-09-01 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://savsoftquiz.com/ Software Link: https://savsoftquiz.com/web/demo.php Version: 5.0 Tested on: Windows 10/Kali Linux Contact:...

Cross-site Scripting (XSS) - Stored in monicahq/monica

Description HTML codes can be entered and successfully run in the journal session of Monica, which allows an attacker to trigger XSS query's like causing a persistant stored XSS in the journal session. files at monica/2. Fix Suggestion Sanitize the input / escape the xss charecters or else escape...

CVE-2020-23983: Improper Neutralization of Input During Web Page Generation

Michael-design iChat Realtime PHP Live Support System 1.6 has persistent Cross-site Scripting via chat,text-filed tags...

CVE-2020-23974: Improper Neutralization of Input During Web Page Generation

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Messagetitle-tag, Add new client all-tags...

PT-2020-15616

Name of the Vulnerable Software and Affected Versions Online Hotel Booking System Pro PHP version 1.3 Description The issue is related to Persistent Cross-site Scripting in the customer registration form, allowing malicious code to be executed. This affects the all-tags section of the form...