Online Pizza Ordering System 跨站脚本漏洞

Online Pizza Ordering System is an online pizza ordering system by Carlo Montero, a personal developer. A security vulnerability exists in Online Pizza Ordering System version 1.0, which originates from a cross-site scripting XSS vulnerability in /php-opos/signup.php, which can be exploited by an...

The vulnerability of the signup.php script in the Dental Clinic Appointment Reservation System allows attackers to perform cross-site scripting attacks.

The vulnerability in the signup.php script of the Dental Clinic Appointment Reservation System relates to insufficient protection of the website’s structure when processing the firstname parameter. Exploiting this vulnerability allows an attacker to perform cross-site scripting attacks remotely...

K47662005: BIG-IP Net HSM script vulnerability CVE-2022-28859

When installing Net HSM, the scripts nethsm-safenet-install.sh and nethsm-thales-install.sh expose the Net HSM partition password. CVE-2022-28859 Impact This vulnerability may allow an authenticated attacker with network access to the Net HSM to use or delete private keys by accessing a...

PT-2023-14530 · WordPress · Simple Membership

Name of the Vulnerable Software and Affected Versions: Simple Membership WordPress plugin versions prior to 4.2.2 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admin...

PT-2023-10147 · Unknown · Pointhi Searx Stats

Name of the Vulnerable Software and Affected Versions: pointhi searx stats affected versions not specified Description: A critical issue has been found in pointhi searx stats, affecting some unknown processing of the file cgi/cron.php, leading to sql injection. Recommendations: Apply a patch to f...

PT-2023-12766 · Nokia · Asik Airscale

Name of the Vulnerable Software and Affected Versions: Nokia ASIK AirScale system module versions 474021A.101 through 474021A.102 Description: A vulnerability exists in Nokia’s ASIK AirScale system module that could allow an attacker to place a script on the file system accessible from Linux. A...

CVE-2022-22763

When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. This vulnerability affects Firefox 96, Thunderbird 91.6, and Firefox ESR 91.6...

CVE-2022-3830

The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

The vulnerability in the implementation of the account.php, login.php, and book_car.php scripts of the CMS system, Official Car Rental System, allows a violator to bypass security restrictions.

The vulnerability in the implementation of the account.php, login.php, and bookcar.php scripts of the Official Car Rental System relates to the lack of measures taken to protect the SQL query structure when processing parameters such as uname, pass, and id. Exploiting this vulnerability allows a...

Design/Logic Flaw

The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted on user devices...

CVE-2022-41576

CVE-2022-41576 affects Huawei HarmonyOS’s rphone module, where a script can be maliciously modified. Successful exploitation may implant irreversible programs on user devices. The provided documents do not reveal a public fix or affected versions; monitor for updates.

The vulnerability of the avahi-daemon-check-dns.sh component of the Avahi service discovery system in local networks allows a perpetrator to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the avahi-daemon-check-dns.sh component of the Avahi service discovery system in local networks is related to the execution of scripts under the authority of the root user. Exploiting this vulnerability allows an attacker to access confidential data, compromise its integrity,...

PT-2022-23822

Name of the Vulnerable Software and Affected Versions Carel pCOWeb HVAC BACnet Gateway versions 2.1.0, Firmware A2.1.0 through B2.1.0, Application Software 2.15.4A Software v16 13020200 Description The Carel pCOWeb HVAC BACnet Gateway is affected by an unauthenticated arbitrary file disclosure...

CVE-2022-38664

Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure job names...

CVE-2022-2679

A vulnerability was found in SourceCodester Interview Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /viewReport.php. The manipulation of the argument id with the input UPDATEXML9729,CONCAT0x2e,0x716b707071,SELECT...

CVE-2022-24992

A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal...

Ambit Technologies Itech Movie Portal Script 安全漏洞

Ambit Technologies Itech Movie Portal Script is a Movie Portal Script from Ambit Technologies, USA. A security vulnerability exists in Ambit Technologies Itech Movie Portal Script version 7.36, which stems from some unknown functionality in movie.php, where manipulation of the parameter f can lea...

Ambit Technologies Itech Movie Portal Script SQL注入漏洞

Ambit Technologies Itech Movie Portal Script is a Movie Portal Script from Ambit Technologies, USA. An SQL injection vulnerability exists in Ambit Technologies Itech Movie Portal Script version 7.36, which stems from an unknown function in shownews.php, where manipulation of the parameter id can...

CVE-2022-28612

Improper Access Control vulnerability leading to multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in Muneeb's Custom Popup Builder plugin = 1.3.1 at WordPress...

CVE-2022-28479

SeedDMS versions 6.0.18 and 5.1.25 and below are vulnerable to stored XSS. An attacker with admin privileges can inject the payload inside the "Role management" menu and then trigger the payload by loading the "Users management" menu...