CVE-2024-41583

CVE-2024-41583 affects DrayTek Vigor3910 devices up to firmware 4.3.2.6, enabling stored XSS by authenticated users due to poor sanitization of the router name. Impact is limited to web UI context with MEDIUM severity (CVSS 3.1: 4.7). Red Hat and NVD corroborate the issue; NCSC notes vendors have...

CVE-2024-41587

Stored XSS, by authenticated users, is caused by poor sanitization of the Login Page Greeting message in DrayTek Vigor310 devices through 4.3.2.6...

PT-2024-36580 · WordPress · Easy Table Of Contents

Name of the Vulnerable Software and Affected Versions: Easy Table of Contents WordPress plugin versions prior to 2.0.66 Description: The issue allows high privilege users, such as editors, to perform Cross-Site Scripting attacks. This is possible because the plugin does not properly sanitise and...

PT-2024-22441 · WordPress · The Betterdocs

Name of the Vulnerable Software and Affected Versions: The BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg versions up to, and including, 3.4.2 Description: The issue arises from insufficient input sanitization and output...

VulnCheck KEV: CVE-2024-2123

The Ultimate Member - User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the several parameters in all versions up to, and including, 2.8.3 due to insufficient input sanitization and...

The vulnerability of the VirusEvent function in the ClamD service of the ClamAV antivirus software allows a hacker to execute arbitrary commands.

The vulnerability of the VirusEvent function in the ClamD service of the ClamAV antivirus software exists because measures to neutralize special elements used in the operating system commands are not taken. Exploiting this vulnerability allows a hacker to execute arbitrary commands...

The vulnerability of the selectEventConfig method in the software for managing power sources of Voltronic Power ViewPower Pro allows a hacker to execute arbitrary SQL code.

The vulnerability of the selectEventConfig method in the software for managing power supply sources of Voltronic Power ViewPower Pro relates to the lack of measures taken to protect the SQL query structure when data cleaning is insufficient. Exploiting this vulnerability could allow an attacker...

CVE-2023-5337

The Contact form Form For All plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'formforall' shortcode in versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacke...

Context - Moderately critical - Cross site scripting - SA-CONTRIB-2019-028

This module enables you to manage contextual conditions and reactions for different portions of your site. The module doesn't sufficiently sanitize user output when displayed leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must hav...

gmailSurf.txt

Anonymous Surfing Via Gmail Login Window - Poor Sanitization User can do anonymous surfing apart form other cool tricks from Gmail login window. The window is small, still checking your mails via google is phun. : 1. Open https://gmail.google.com/?dest=http%3A%2F%2Fblablabla. 2. The login window...