PT-2021-20613

Name of the Vulnerable Software and Affected Versions: The Shopping Cart & eCommerce Store WordPress plugin versions up to and including 5.1.0 Description: The issue is related to Cross-Site Request Forgery, allowing attackers to inject arbitrary web scripts via the save currency settings functio...

CVE-2020-25564

In SapphireIMS 5.0, it is possible to create local administrator on any client with credentials of a non-privileged user by directly accessing RemoteMgmtTaskSave Automation Tasks feature...

CVE-2020-25566

In SapphireIMS 5.0, it is possible to take over an account by sending a request to the SavePassword form as shown in POC. Notice that we do not require a JSESSIONID in this request and can reset any user’s password by changing the username to that user and password to base64desired password...

PT-2021-11153

Name of the Vulnerable Software and Affected Versions: SapphireIMS version 5.0 Description: The issue allows for account takeover by sending a request to the "Save Password" form. This can be done without requiring a JSESSIONID, enabling the reset of any user's password by modifying the username ...

SapphireIMS Access Control Vulnerability

Tecknodreams SapphireIMS is an ITIL 2011 certified Enterprise Service Management System from Tecknodreams India. A security vulnerability exists in SapphireIMS 5.0, which stems from the software's Save Password form not filtering requests enough to allow an attacker to send a request to take over...

CVE-2021-24467: Cross-Site Request Forgery (CSRF)

The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the...

PT-2021-10212 · Unknown · Ignited Cms

Name of the Vulnerable Software and Affected Versions: IgnitedCMS version 1.0 Description: The issue allows remote attackers to obtain sensitive information and gain privilege via the component "/admin/profile/save profile". This is a Cross Site Request Forgery CSRF issue, which can be exploited ...

CVE-2021-34631

The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handlesavestyle function found in the /news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18...

PT-2021-20599

Name of the Vulnerable Software and Affected Versions: NewsPlugin WordPress plugin versions up to and including 1.0.18 Description: The issue allows attackers to inject arbitrary web scripts via Cross-Site Request Forgery, leveraging the handle save style function found in the /news-plugin.php...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

OSV-2021-1074 Use-of-uninitialized-value in SkBaseDevice::save

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36647 Crash type: Use-of-uninitialized-value Crash state: SkBaseDevice::save SkCanvas::internalSave SkCanvas::internalSaveLayer...

PT-2021-27678

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the SkBaseDevice::save function, which is called by...

DevSecOps Training - Data Center Attack: The Game

See what it’s like as a security decision maker in Data Center Attack: The Game. Will your decisions help save lives?...

CVE-2021-26230

Cross-site scripting XSS vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the user information to saveuser.php...

PT-2021-16971

Name of the Vulnerable Software and Affected Versions SourceCodester CASAP Automated Enrollment System version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via the user information to "save user.php". This can lead to cross-site scripting XSS attacks...

Form Maker < 1.13.60 - Authenticated Stored XSS

The plugin does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue Create or edit a form and add the following payload in the Form Title field "autofocus onmouseover=alert/XSS///...

Stripe: HTML Injection in the Invoice memos field

The memo field in customer invoices on Stripe was vulnerable to HTML injection, allowing an attacker to create a login form and steal a victim's login credentials through the auto-save functionality of their browser. This could result in the takeover of a victim's account...

CVE-2020-20391

Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via 1 Add Snippet and 2 Save snippets...

CVE-2020-20391

Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via 1 Add Snippet and 2 Save snippets...

PT-2021-10487

Name of the Vulnerable Software and Affected Versions: GetSimpleCMS version 3.4.0a Description: The issue is related to a Cross Site Scripting vulnerability. It affects the admin/snippets.php file via two specific actions: 1 Add Snippet and 2 Save snippets. Recommendations: For GetSimpleCMS versi...