5876 matches found
CVE-2020-20391: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in GetSimpleCMS 3.4.0a in admin/snippets.php via 1 Add Snippet and 2 Save snippets...
getsimplecms cross-site scripting vulnerabilities
GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A cross-site scripting vulnerability exists in admin/snippets.php in GetSimple CMS version 3.4.0a. An attacker can exploit this vulnerability via Add Snippet and Save snippets to conduct cross-site...
NSClient++ 0.5.2.35 Remote Code Execution Exploit
This Metasploit module allows an attacker with knowledge of the admin password of NSClient++ to start a privileged shell. For this module to work, both web interface of NSClient++ and ExternalScripts feature should be enabled. This module requires Metasploit: https://metasploit.com/download Curre...
CVE-2021-33031
In LabCup before v2next18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email...
CVE-2021-34546
An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to...
CVE-2021-33031
In LabCup before v2next18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email...
CVE-2021-34546
An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to...
Authentication flaw
In LabCup before v2next18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email...
PT-2021-20023
Name of the Vulnerable Software and Affected Versions LabCup versions prior to 6.3.0.03 Description The issue allows unauthorized actions to be performed by users without access to user management, potentially leading to account takeover. An attacker can change another user's email address if the...
PT-2021-20540
Name of the Vulnerable Software and Affected Versions: NetSetMan Pro versions prior to 5.0 Description: An unauthenticated attacker with physical access to a computer, where the pre-logon profile switch button within the Windows logon screen is enabled, can drop to an administrative shell and...
CVE-2021-34546: Improper Authentication
An unauthenticated attacker with physical access to a computer with NetSetMan Pro before 5.0 installed, that has the pre-logon profile switch button within the Windows logon screen enabled, is able to drop to an administrative shell and execute arbitrary commands as SYSTEM via the "save log to...
LabCup authorization issue vulnerability
LabCup is a laboratory and research organization software management system from LabCup Ireland. It helps academic researchers and safety officers with chemical inventory management, risk assessment and compliance. An authorization issue vulnerability exists in LabCup, which arises from the abili...
SUSE: Security Advisory (SUSE-SU-2018:2037-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2021-24333
The CVE-2021-24333 case involves the Content Copy Protection & Prevent Image Save WordPress plugin (
PT-2021-15870
Name of the Vulnerable Software and Affected Versions Content Copy Protection & Prevent Image Save WordPress plugin versions prior to 1.4 Description The issue allows attackers to make a logged-in administrator set arbitrary XSS payloads in the plugin's settings due to the lack of CSRF checks and...
CVE-2021-24333: Cross-Site Request Forgery (CSRF)
The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings, not perform any validation and sanitisation on them, allowing attackers to make a logged in administrator set arbitrary XSS payloads in them...
WordPress plugin: Content Copy Protection & Prevent Image Save – Cross-site scripting vulnerabilities
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the Conten...
WordPress Cookie Law Bar 1.2.1 Cross Site Scripting
Exploit Title: WordPress Plugin Cookie Law Bar 1.2.1 - 'clbbarmsg' Stored Cross-Site Scripting XSS Date: 2021-05-24 Exploit Author: Mesut Cetin Vendor Homepage: https://www.cookielawinfo.com/wordpress-plugin/ Software Link: https://wordpress.org/plugins/cookie-law-bar/ Version: 1.2.1 Tested on:...
CVE-2021-24292
The Happy Addons for Elementor WordPress plugin before 2.24.0, Happy Addons Pro for Elementor WordPress plugin before 1.17.0 have a number of widgets that are vulnerable to stored Cross-Site ScriptingXSS by lower-privileged users such as contributors, all via a similar method: The “Card” widget...