CVE-2024-5406 Multiple vulnerabilities in WinNMP from Wtriple

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details...

CVE-2024-5406

CVE-2024-5406 affects WinNMP 19.02, where an XSS flaw exists in the index page via the from, subject, text, and hash parameters. A remote attacker could send a specially crafted query to an authenticated user, potentially stealing session details. The NVD entry lists CVSSv3.1: AV:N/AC:L/PR:N/UI:R...

CVE-2024-5406 Multiple vulnerabilities in WinNMP from Wtriple

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via index page in from, subject, text and hash parameters. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their session details...

CVE-2024-5405

WinNMP 19.02 contains an XSS vulnerability exploitable via /tools/redis.php, specifically in the k, hash, key, and p parameters. A remote attacker could inject JavaScript to fetch an authenticated user’s session details. The issue is documented across multiple sources (CVE-2024-5405, RH, NVD, CVE...

CVE-2024-5405 Multiple vulnerabilities in WinNMP from Wtriple

A vulnerability had been discovered in WinNMP 19.02 consisting of an XSS attack via /tools/redis.php page in the k, hash, key and p parameters. This vulnerability could allow a remote user to submit a specially crafted JavaScript payload for an authenticated user to retrieve their session details...

WinNMP 跨站脚本漏洞

WinNMP is a WinNMP package for quickly setting up a development server. A cross-site scripting vulnerability exists in WinNMP version 19.02, which stems from susceptibility to cross-site scripting XSS attacks that could allow an attacker to retrieve session details by submitting a specially craft...

PT-2024-36025 · Rhinos +1 · Rhinos +1

Name of the Vulnerable Software and Affected Versions: RhinOS versions 3.0-1190 Description: The issue allows for an XSS attack via the tamper parameter in the "/admin/lib/phpthumb/phpthumb.php" API endpoint. An attacker could create a malicious URL and send it to a victim to obtain their session...

PHP Server Monitor vulnerable to Cross-site Scripting

PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/testscript/index.php page in all visible parameters. An attacker could create a specially crafted URL, send it to a victim and retrieve their session details...

GHSA-RQ7F-J68F-MQH3 PHP Server Monitor vulnerable to Cross-site Scripting

PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/testscript/index.php page in all visible parameters. An attacker could create a specially crafted URL, send it to a victim and retrieve their session details...

CVE-2024-5312

PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/testscript/index.php page in all visible parameters. An attacker could create a specially crafted URL, send it to a victim and retrieve their session details...

CVE-2024-5312 Cross-Site Scripting vulnerability in PHP Server Monitor

PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/testscript/index.php page in all visible parameters. An attacker could create a specially crafted URL, send it to a victim and retrieve their session details...

CVE-2024-5312

CVE-2024-5312 describes an XSS in PHP Server Monitor 3.2.0. Affected component: the index.php under /vendor/phpmailer/phpmailer/test_script/index.php, where all visible parameters are vulnerable. An attacker can craft a URL that, when visited by a user, could expose the victim’s session details. ...

CVE-2023-5052

vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /usextra/phpinfo.php page. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and partially take over their session details...

CVE-2023-5052 Cross Site Scripting (XSS) in Servidor Uniforme Zero

vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /usextra/phpinfo.php page. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and partially take over their session details...

CVE-2023-5052

CVE-2023-5052 concerns Uniform Server Zero (v10.2.5) with a cross-site scripting (XSS) flaw in the /us_extra/phpinfo.php page. The vulnerability enables an attacker to craft a query that, when viewed by an authenticated user, can partially hijack session details, as described in the CVE. The CVSS...

CVE-2024-4336 Múltiple vulnerabilities on Adive Framework

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability via the /adive/admin/tables/add, in multiple parameters. An attacker could retrieve the session details of an authenticated user...

CVE-2024-4336

CVE-2024-4336 affects Adive Framework 2.0.8. The vulnerability is a persistent XSS due to insufficient encoding of user-controlled inputs, exploitable via the /adive/admin/tables/add endpoint across multiple parameters. The available documents indicate an attacker could retrieve the session detai...

CVE-2024-4337

CVE-2024-4337 affects Adive Framework 2.0.8. The root cause is insufficient encoding of user-controlled inputs, causing a persistent XSS vulnerability via the /adive/admin/nav/add endpoint across multiple parameters. This can enable an attacker to retrieve authenticated user session details. Publ...

CVE-2024-4337 Múltiple vulnerabilities on Adive Framework

Adive Framework 2.0.8, does not sufficiently encode user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability via the /adive/admin/nav/add, in multiple parameters. This vulnerability allows an attacker to retrieve the session details of an authenticated user...

PT-2024-30533 · Unknown · Adive Framework

Name of the Vulnerable Software and Affected Versions: Adive Framework version 2.0.8 Description: The issue is related to insufficient encoding of user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited via the...