1162455 matches found
CVE-2026-51565
CVE-2026-51565 CVE-2026-51565 的安全公告 描述 Milk admin =0.9.8 中 Modules/Docs/DocsController.php 存在跨站脚本（XSS）漏洞，远程攻击者可通过特制请求中的 action 参数注入任意 Web 脚本或 HTML 缓解措施 截至发布之时，该漏洞尚无来自开发者的官方补丁，距我报告此问题已过去 5 个月。在更新版本发布之前，建议部署 Web 应用防火墙（WAF），例如配置了适当 XSS 防护规则的 ModSecurity ，以帮助拦截针对易受攻击的 action...
CVE-2023-46974
CVE-2023-46974 POC 描述 Best Courier Management System 中的跨站脚本漏洞 v.1.000 允许远程攻击者通过 精心构造的载荷传递给 URL 中的 page 参数来执行任意代码。 漏洞类型 跨站脚本攻击 XSS 产品供应商 https://www.sourcecodester.com/php/16848/best-courier-management-system-project-php.html 受影响的产品代码库 v 1.000 - 最佳快递管理系统 受影响的组件 所有 URL 攻击类型 远程 影响代码执行 true 攻击向量...
CVE-2026-36226
CVE-2026-36226: Prueba de Concepto XSS de Crear Nuevo Usuario de Proyecto en Advantech WebAccess/SCADA Este repositorio contiene una prueba de concepto benigna para CVE-2026-36226, un problema de cross-site scripting en Advantech WebAccess/SCADA 8.0-2015.08.16. Este repositorio es solo para...
CVE-2026-105173
A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attac...
CVE-2026-105173 code-projects Human Resource Management Event Creation EventStore.php cross site scripting
A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attac...
CVE-2026-105173
A cross-site scripting (XSS) vulnerability exists in code-projects Human Resource Management 1.0 . The flaw is located within the Event Creation component, specifically affecting an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php. By manipulating the eventSubject ...
PT-2026-106012
Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the share mini page in Event Gallery extension 6.6.0 - The page a shared image link opens the share mini page of the front end can link the article the image was shared from when the option "Share article links" is on. I...
CVE-2026-105289: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...
CVE-2026-105291: Improper Neutralization of Input During Web Page Generation
A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...
EUVD-2026-92703
Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...
PT-2026-104662
A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attac...
PT-2026-106027
A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...
PT-2026-106000
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update questio...
CVE-2026-95165: Undefined Security Weakness
Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting XSS in the Organization name field...
Debian dla-4823 : roundcube - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4823 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4823-1 [email protected]...
AlmaLinux 9 : osbuild-composer (ALSA-2026:69293)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69293 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...
AlmaLinux 10 : osbuild-composer (ALSA-2026:66432)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:66432 advisory. golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821...
RHEL 7 : rhc-worker-script (RHSA-2026:75689)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:75689 advisory. Remote Host Configuration rhc worker for executing scripts on hosts managed by Red Hat Lightspeed. Security Fixes: encoding/asn1: golang: G...
CVE-2002-0346
CVE-2002-0346 Cobalt RAQ 4 中的跨站脚本漏洞允许远程攻击者通过在 URL 中向 1 service.cgi 或 2 alert.cgi 注入 Javascript，以其他 Cobalt 用户的身份执行任意脚本。 Packetstorm 发布内容见 https://packetstormsecurity.com/files/25837/Colbalt-RAQ-v4.txt.html SecurityFocus 发布内容见 https://www.securityfocus.com/bid/4211 作者 Alex Hernandez 又名 @alt3kx 厂商回应...