CVE-2021-41322: Undefined Security Weakness

Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password reset process...

CVE-2021-41293

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information...

PT-2021-23247

Name of the Vulnerable Software and Affected Versions ECOA BAS controller affected versions not specified Description The ECOA BAS controller is affected by a path traversal issue, which allows for the disclosure of arbitrary files. This can be exploited by unauthenticated attackers using a...

CVE-2021-41293: Improper Limitation of a Pathname to a Restricted Directory

ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files disclosure. Using the specific POST parameter, unauthenticated attackers can remotely disclose arbitrary files on the affected device and disclose sensitive and system information...

GamePress <= 1.1.0 - Reflected Cross-Site Scripting

The plugin does not escape the opedit POST parameter before outputting it back in multiple Game Option pages, leading to Reflected Cross-Site Scripting issues PoC Affected pages: op=engines, op=perspectives, op=modes, op=genres, op=themes, op=platforms...

Improper Access Control in alanaktion/mchostpanel

✍️ Description The php file install.php creates an admin account using POST parameter user, pass, dir, ram, port without any access control enforced nor check if the admin account has been created nor check if the file .installed exists before account creation. It is possible for any network user...

Cross-site Scripting (XSS) - Reflected in kasuganosoras/pigeon

✍️ Description Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. The...

CVE-2021-35238

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website...

CVE-2021-35238

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website...

CVE-2021-35238

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website...

CVE-2021-35238 Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website...

CVE-2021-35238

SolarWinds Orion Platform XSS (CVE-2021-35238): A stored Cross-Site Scripting flaw exists when a user with Orion Admin Rights stores input through a URL POST parameter on CreateExternalWebsite. Affected products/versions include Orion Platform 2020.2.0 prior to 2020.2.6 HF1; exploitation requires...

Cross-site Scripting (XSS) - Reflected in pi-hole/adminlte

✍️ Description Reflected XSS in POST /admin/scripts/pi-hole/php/customcname.php 🕵️‍♂️ Proof of Concept 1. Login as admin, Go to Local DNS - CNAME Records - Add a new CNAME record 2. Input alert1 in domain field and anything in target domain. 3. The Payload in post body domain is URL encoded, use a...

Solarwinds Orion Platform跨站脚本漏洞

Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices, as well as support for customized web interfaces, multiple user comments, and map-based views of the entire...

CVE-2021-35238: Improper Neutralization of Input During Web Page Generation

User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website...

PT-2021-20860

Name of the Vulnerable Software and Affected Versions: Orion Platform affected versions not specified Description: The issue allows a user with Orion Platform Admin Rights to store XSS through a URL POST parameter in the CreateExternalWebsite website. No information is provided about the estimate...

PT-2021-16072

Name of the Vulnerable Software and Affected Versions The Simple Events Calendar WordPress plugin versions prior to 1.4.1 Description The issue arises from the lack of sanitization, validation, or escaping of the event id POST parameter before its use in a SQL statement when deleting events. This...

CVE-2021-24555: Improper Neutralization of Special Elements used in an SQL Command

The daacdeletebookingcallback function, hooked to the daacdeletebooking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and...

CVE-2021-29056

Pixelimity 1.0 is affected by a Cross Site Scripting (XSS) vulnerability that can be triggered via an HTTP POST parameter to admin/setting.php. The root cause is a lack of proper validation/sanitization of client-side data in the web app. The impact is client-side code execution, potentially affe...

PT-2021-18052

Name of the Vulnerable Software and Affected Versions: Pixelimity version 1.0 Description: A Cross Site Scripting XSS issue exists, allowing potential attacks via the HTTP POST parameter to the "admin/setting.php" endpoint. This could enable malicious scripts to be executed on the client-side...