264 matches found
CVE-2024-5532
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in OpenText™ Operations Agent. The XSS vulnerability could allow an attacker with local admin permissions to manipulate the content of the internal status page of the Agent on the local system...
PT-2024-36507 · Opentext · Opentext Operations Agent
Name of the Vulnerable Software and Affected Versions: OpenText Operations Agent versions 12.20 through 12.26 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This could allow an attacker with local admin...
CVE-2024-10154
A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file status.php of the component Check Booking Status Page. The manipulation of the argument emailid leads to sql injection. The attack may be...
CVE-2024-10154 PHPGurukul Boat Booking System Check Booking Status Page status.php sql injection
A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file status.php of the component Check Booking Status Page. The manipulation of the argument emailid leads to sql injection. The attack may be...
CVE-2024-10154 PHPGurukul Boat Booking System Check Booking Status Page status.php sql injection
A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file status.php of the component Check Booking Status Page. The manipulation of the argument emailid leads to sql injection. The attack may be...
PHPGurukul Boat Booking System SQL注入漏洞
PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. A SQL injection vulnerability exists in version 1.0 of the PHPGurukul Boat Booking System, which originates from an SQL injection vulnerability in the emailid parameter in the status.php page of the Check Booking Status Page...
7 Rapid Questions on our Belfast Placement Programme: Orla Magee and Paddy McDermott
Ever wonder what it’s like to be an intern at Rapid7 in Belfast? Software Engineers Orla Magee and Paddy McDermott share what the interview process looked like for them, along with impactful projects and advice for others exploring Rapid7’s Placement Programme. What was the interview process like...
itsourcecode Alton Management System SQL注入漏洞
itsourcecode Alton Management System is an online restaurant management system from itsourcecode. A SQL injection vulnerability exists in version 1.0 of itsourcecode Alton Management System, which stems from an SQL injection vulnerability in the rcode function of the /reservationstatus.php page...
CVE-2023-48501 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...
Attribute Injection leading to XSS(Cross-Site-Scripting)
Summary Google Analytics element Attribute Injection leading to XSS Details Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. PoC 1. Run the lates...
PHPGurukul Restaurant Table Booking System Security Vulnerability
PHPGurukul Restaurant Table Booking System is a restaurant table booking system. A security vulnerability exists in PHPGurukul Restaurant Table Booking System version 1.0, which originates from a SQL injection vulnerability in the file check-status.php of the component Booking Reservation Handler...
CVE-2023-43661
Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch...
Design/Logic Flaw
Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch...
CVE-2023-43661
CVE-2023-43661 (Cachet) affects Cachet prior to the 2.4 branch, where the template functionality could let an attacker execute code on the server due to inadequate input filtration and an old Twig version. The issue is mitigated by a patch in the 2.4 branch (commit 6fb043e109d2a262ce3974e863c54e9...
CVE-2023-43661 Cachet vulnerable to Authenticated Remote Code Execution
Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch...
CVE-2023-31851
Cudy LT400 1.13.4 is has a cross-site scripting XSS vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter...
Cudy Technology LT400 跨站脚本漏洞
The Cudy Technology LT400 is a wireless router from the Chinese company Cudy Technology. A security vulnerability exists in the Cudy Technology LT400 version 1.13.4, which originates from a security issue in the iface parameter in /cgi-bin/luci/admin/network/wireless/status...
The vulnerability in the web administration interface of the Local Status Page (LSP) of Cisco Meraki software for network devices allows a hacker to trigger a service failure or gain unauthorized access to protected information.
The vulnerability of the administration web interface for Local Status Pages LSP in Cisco Meraki network devices stems from the low entropy of default account credentials. Exploiting this vulnerability could allow an attacker to cause service interruptions or gain unauthorized access to protected...
Cisco Meraki Local Status Page Configuration Hardening
Cisco Meraki devices implement a Local Status Page LSP feature. This is a web-based interface that is primarily intended to provide administrators with the ability to apply configuration settings that are required for the device to connect to the Cisco Meraki Dashboard, perform local...
