CVE-2023-49034

Cross Site Scripting XSS vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files...

PT-2024-13669 · Projeqtor · Projeqtor

Name of the Vulnerable Software and Affected Versions: ProjeQtOr version 11.0.2 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via a crafted script to the checkvalidHtmlText function in the ack.php and security.php files. This enables the attacker...

CVE-2023-49034: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files...

Projeqtor Cross-Site Scripting Vulnerability

Projeqtor is a PHP-based open source project management software from the Projeqtor community. The software is used to organize various functions required for multiple projects and is suitable for IT projects. A cross-site scripting vulnerability exists in Projeqtor version 11.0.2, which originat...

CVE-2023-49034

Cross Site Scripting XSS vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files...

CVE-2021-44565

A Cross Site Scripting XSS vulnerability exists in RosarioSIS before 7.6.1 via the xssclean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields...

CVE-2021-44565: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability exists in RosarioSIS before 7.6.1 via the xssclean function in classes/Security.php, which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields...

PT-2022-12162

Name of the Vulnerable Software and Affected Versions RosarioSIS versions prior to 7.6.1 Description A Cross Site Scripting XSS issue exists, allowing remote malicious users to inject arbitrary JavaScript or HTML via the xss clean function in classes/Security.php. Affected components include all...

PT-2021-10607

Name of the Vulnerable Software and Affected Versions: CSZ CMS version 1.2.4 Description: The issue is related to an arbitrary file upload vulnerability. It affects the /core/MY Security.php component. Recommendations: For CSZ CMS version 1.2.4, consider restricting access to the /core/MY...

PT-2021-10852

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.60 Description A stored cross site scripting XSS vulnerability in "/administration/setting security.php" allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations For...

PT-2019-13121

Name of the Vulnerable Software and Affected Versions CSZ CMS version 1.2.2 Description The issue allows for SQL injection by sending a crafted HTTP User-Agent header and omitting the csrf csz parameter in the core/MY Security.php file. Recommendations For CSZ CMS version 1.2.2, as a temporary...

CVE-2016-10510

Cross-site scripting XSS vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the stripimagetags protection mechanism in system/classes/Kohana/Security.php...

PT-2017-7908

Name of the Vulnerable Software and Affected Versions Kohana versions prior to 3.3.6 Description A cross-site scripting XSS issue exists in the Security component, allowing remote attackers to inject arbitrary web script or HTML by bypassing the strip image tags protection mechanism in...

CVE-2016-10510: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Security component of Kohana before 3.3.6 allows remote attackers to inject arbitrary web script or HTML by bypassing the stripimagetags protection mechanism in system/classes/Kohana/Security.php...

PT-2017-7558

Name of the Vulnerable Software and Affected Versions BulletProof Security plugin versions prior to .52.5 Description The issue allows for XSS to be possible for remote authenticated administrators via the DBTablePrefix parameter in the admin/db-backup-security/db-backup-security.php page...

Joomla Incapsula 1.4.6_b Cross Site Scripting Vulnerability

Joomla Incapsula component versions 1.4.6b and below suffer from a reflective cross site scripting vulnerability. Joomla Incapsula Component target="blank" class="IFJlink" Click here to upgrade your account Patch: ------ 22: " target="blank" class="IFJlink"Click here to upgrade your account...

Joomla Incapsula 1.4.6_b Cross Site Scripting

Joomla Incapsula Component target="blank" class="IFJlink" Click here to upgrade your account Patch: ------ 22: " target="blank" class="IFJlink"Click here to upgrade your account -------------------------------------------------------------------------- Tested on: Microsoft Windows 7 Ul...

CVE-2010-4335: Improper Input Validation

The validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted dataTokenfields value that is processed by the unserialize function, as demonstrated by...

Geeklog SEC_authenticate()函数SQL注入漏洞

BUGTRAQ ID: 34456 Geeklog是一个免费的、开放源码的Web应用程序。它可以使用户创建一个虚拟的社区，可以管理用户，张贴文章等。Geeklog采用PHP实现，以MySQL为后台数据库。 Geeklog的index.php模块中的SECauthenticate函数没有正确的验证用户所提交的PHPAUTHUSER和 REMOTEUSER变量参数，远程攻击者可以通过提交恶意查询请求执行SQL注入攻击。以下是/publichtml/webservices /atom/index.php文件中34-53行的有漏洞代码段： ... requireonce...

Geeklog <= 1.5.2 SEC_authenticate() SQL Injection Exploit

Exploit for unknown platform in category web applications ========================================================= Geeklog = 5.0 google dorks: "By Geeklog" "Created this page in" +seconds +powered "By Geeklog" "Created this page in" +seconds +powered inurl:publichtml vulnerability, see...