CVE-2023-6440: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Book Borrower System 1.0 and classified as problematic. This issue affects some unknown processing of the file endpoint/add-book.php. The manipulation of the argument Book Title/Book Author leads to cross site scripting. The attack may be initiated...

PT-2023-32668 · Sourcecodester · Sourcecodester Book Borrower System

Name of the Vulnerable Software and Affected Versions: SourceCodester Book Borrower System version 1.0 Description: A vulnerability was found in the system, classified as problematic, affecting some unknown processing of the file "add-book.php". The manipulation of the argument Book Title or Book...

Book Borrower System Cross-Site Scripting Vulnerability

Book Borrower System is a book borrowing system by the individual developer Remy Andrade. A cross-site scripting vulnerability exists in Book Borrower System version 1.0, which stems from an incorrect manipulation of the Book Title/Book Author parameter that can lead to cross-site scripting...

CVE-2023-48881

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...

CVE-2023-48881

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...

PT-2023-30996 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.6.4-UTF8-SP1 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at "/login.php?m=admin&c=Field&a=arctype...

CVE-2023-48881

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...

CVE-2023-48881: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...

Malicious code in one-host-page-title-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc83e2b70cb22321c16a33d9cc90936f0f9275da7342c5abeb2484717beea336 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in one-host-page-title-management

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-48078

SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter...

CVE-2023-48078

SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter...

PT-2023-30614 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.94 through 7.4.3.95 Description: A reflected cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via the p l back url title parameter on a content page's edit page...

Liferay Portal Security Vulnerability

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, and more. A security vulnerability exists in Liferay Portal...

Simple CRUD Functionality Security Vulnerability

Simple CRUD Functionality is a web application. A security vulnerability exists in code-projects Simple CRUD Functionality v1.0, which stems from an SQL injection vulnerability that allows attackers to run arbitrary SQL commands via the title parameter...

PT-2023-30691 · Unknown · Simple Crud Functionality

Name of the Vulnerable Software and Affected Versions: Simple CRUD Functionality version 1.0 Description: The issue allows attackers to run arbitrary SQL commands via the title parameter in the "add.php" file. This can lead to unauthorized access and manipulation of database content...

CVE-2023-48078: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter...

SuiteCRM 代码注入漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from an HTML injection vulnerability that stems from a lack of valid filtering and escaping of user-supplied data in the salesagility/suitecrm tittle, which can be exploited by an attacker to cause HTML...

The vulnerability of the set_term_title() function (ipython/IPython/utils/terminal.py) in the command interface for interactive computations in IPython, allowing a hacker to execute arbitrary commands.

The vulnerability of the settermtitle function in the IPython/ipython/utils/terminal.py command interface exists due to the lack of measures to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability could allow a malicious individual to execute...

GHSA-RMXW-C48H-2VF5 XWiki Platform privilege escalation from script right to programming right through title displayer

Impact In XWiki Platform, it's possible for a user to write a script in which any velocity content is executed with the right of any other document content author. To reproduce: As a user with script but not programming right, create a document with the following content: velocity set$main =...