686 matches found
Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting
Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link:...
Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link:...
Design/Logic Flaw
Concrete5 8.4.3 has XSS because config/concrete.php allows uploads by administrators of SVG files that may contain HTML data with a SCRIPT element...
Cross site scripting
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
Design/Logic Flaw
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19601
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19601
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19600
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19600
Rhymix CMS 1.9.8.1 is affected by a Cross‑Site Scripting (XSS) vulnerability in the index.php?module=admin&act=dispModuleAdminFileBox page, exploitable by uploading a specially crafted SVG file. The root cause is the handling of SVG uploads that allows injected scripts/HTML to execute in the cont...
CVE-2018-19600
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19601
CVE-2018-19601 : Rhymix CMS 1.9.8.1 is affected by an SSRF via an SVG upload in index.php?module=admin&act=dispModuleAdminFileBox. The entry documents an SSRF risk but provides no public details on affected files beyond the described vector. CVSS metrics indicate high/severe impact (CVSS3 base sc...
CuppaCMS Cross-Site Scripting Vulnerability (CNVD-2019-00811)
CuppaCMS is a content management system CMS. A cross-site scripting vulnerability exists in CuppaCMS. A remote attacker can exploit this vulnerability by uploading a specially crafted SVG document to the administrator//component/tablemanager/view/cuviews URI to execute JavaScript script...
CVE-2018-19918
CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...
CVE-2018-19918
CuppaCMS has XSS via an SVG document uploaded to the administrator//component/tablemanager/view/cuviews URI...
PT-2018-15163 · Cuppacms · Cuppacms
Name of the Vulnerable Software and Affected Versions: CuppaCMS affected versions not specified Description: The issue is related to a Cross-Site Scripting XSS attack. It occurs when an SVG document is uploaded to the administrator//component/table manager/view/cu views URI, allowing malicious...
CVE-2018-16630
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file...
Design/Logic Flaw
CMSimple 4.7.5 has XSS via an admin's upload of an SVG file at a ?userfiles&subdir=userfiles/images/flags/ URI...
CVE-2018-19597
CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document, a related issue to CVE-2017-16798...