118 matches found
PT-2020-16136 · Moodle · Moodle
Name of the Vulnerable Software and Affected Versions: Moodle versions 3.9 through 3.9.1 Description: The issue concerns a stored XSS risk due to insufficient sanitizing in the moodlenetprofile user profile field. This poses a risk as it can lead to the execution of malicious scripts stored in th...
Invision Community 4.5.4 Cross Site Scripting
Exploit Title: Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting Date: 02-12-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://invisioncommunity.com/ Software Link: https://invisioncommunity.com/buy Version: 4.5.4 Tested on: Windows 10/Kali Linux Vulnerable...
CVE-2020-25115
The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...
Design/Logic Flaw
The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...
CVE-2020-25115
The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager...
CVE-2020-25115
Vulnerability overview: CVE-2020-25115 affects vBulletin 5.6.3 Admin CP, enabling cross-site scripting (XSS) via an Occupation Title or Description in the User Profile Field Manager. Affected component is the Admin CP interface; root cause aligns with input handling in profile field manager allow...
CVE-2020-15070
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value...
Code injection
Zulip Server 2.x before 2.1.7 allows eval injection if a privileged attacker were able to write directly to the postgres database, and chose to write a crafted custom profile field value...
CVE-2020-15070
Zulip Server 2.x before 2.1.7 is affected by an eval-injection vulnerability that an attacker with privilege and access to write to the PostgreSQL database can exploit by crafting a custom profile field value. The root cause is the ability to inject and evaluate code via a crafted value stored in...
Nagios Log Server Cross-Site Scripting Vulnerability (CNVD-2020-17470)
Nagios Log Server is a powerful enterprise-grade log monitoring and management application that allows organizations to quickly and easily view, sort, and configure logs from any source on any given network. A cross-site scripting vulnerability exists in Nagios Log Server 2.1.3. An attacker can...
PHP Scripts Mall Website Seller Script Cross-Site Scripting Vulnerability (CNVD-2019-21121)
PHP Scripts Mall Website Seller Script is an e-commerce website system script from PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall Website Seller Script version 2.0.5, which can be exploited by remote attackers to inject arbitrary web script or HTML via the...
CVE-2018-20530
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...
CVE-2018-20530
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...
Design/Logic Flaw
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...
CVE-2018-20530
The CVE pertains to PHP Scripts Mall Website Seller Script 2.0.5, with an XSS vulnerability exposed via the Profile field (e.g., Company Address/Personal Address). The issue is associated with CVE-2018-20530 and related to CVE-2018-15896. According to the provided documents, the vulnerability ena...
CVE-2018-20530
PHP Scripts Mall Website Seller Script 2.0.5 has XSS via a Profile field such as Company Address, a related issue to CVE-2018-15896...
CVE-2018-13304
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studioprofile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to errorresilience.c, h263dec.c, and...
CVE-2018-13304
In libavcodec in FFmpeg 4.0.1, improper maintenance of the consistency between the context profile field and studioprofile in libavcodec may trigger an assertion failure while converting a crafted AVI file to MPEG4, leading to a denial of service, related to errorresilience.c, h263dec.c, and...