CVE-2023-45138 Change Request Application vulnerable to XSS and remote code execution through change request title

Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an...

Lost And Found Information System 1.0 Insecure Direct Object Reference

Exploit Title: Lost and Found Information System v1.0 - idor leads to Account Take over Date: 2023-12-03 Exploit Author: OR4NG.M4N Category : webapps CVE : CVE-2023-38965 Python p0c : import argparse import requests import time parser = argparse.ArgumentParserdescription='Send a POST request to t...

CVE-2023-45138: Improper Neutralization of Input During Web Page Generation

Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an...

WordPress Sort SearchResult By Title Plugin <= 10.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Sort SearchResult By Title Type Plugin Vulnerable versions = 10.0 Fixed in 11.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45639 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3afb47c8e79f Credits Skalucy...

CVE-2023-5495: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in QDocs Smart School 6.4.1. It has been classified as critical. This affects an unknown part of the file /course/filterRecords/ of the component HTTP POST Request Handler. The manipulation of the argument searchdata0title/searchdata0searchfield/searchdata0searchvalue...

PT-2023-32134

Name of the Vulnerable Software and Affected Versions QDocs Smart School version 6.4.1 Description A critical issue has been found in QDocs Smart School. This issue affects the /course/filterRecords/ file of the HTTP POST Request Handler component. The manipulation of the searchdata0title,...

PT-2023-29531 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.39.5 MediaWiki versions 1.40.x prior to 1.40.1 Description: An issue was discovered in VectorComponentUserLinks.php in the Vector Skin component. A MalformedTitleException is uncaught if it is not a valid title,...

DEBIAN-CVE-2023-45364

An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestam...

CVE-2023-44758

GDidees CMS 3.0 is affected by a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title...

CVE-2023-44758

GDidees CMS 3.0 is affected by a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title...

CVE-2023-44758

GDidees CMS 3.0 is affected by a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title...

Cross site scripting

GDidees CMS 3.0 is affected by a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title...

CVE-2023-44758

GDidees CMS 3.0 is affected by a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title...

PT-2023-29282 · Unknown · Gdidees Cms

Name of the Vulnerable Software and Affected Versions: GDidees CMS version 3.0 Description: The issue is a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title. This enables attackers to inject malicious scripts into the...

CVE-2023-44758

GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title. The issue is documented as CVE-2023-44758 with a CVSS v3.1 base score of 5.4 (Medium) and is described across multiple sources (NVD, R...

CVE-2023-44758: Improper Neutralization of Input During Web Page Generation

GDidees CMS 3.0 is affected by a Cross-Site Scripting XSS vulnerability that allows attackers to execute arbitrary code via a crafted payload to the Page Title...

Design/Logic Flaw

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface ZMI. All versions of Zope 4 and Zope 5 are affected. Patches will be released wit...

PYSEC-2023-193

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface ZMI. All versions of Zope 4 and Zope 5 are affected. Patches will be released wit...

CVE-2023-44389 Zope management interface vulnerable to stored cross site scripting via the title property

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface ZMI. All versions of Zope 4 and Zope 5 are affected. Patches will be released wit...

CVE-2023-44389

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface ZMI. All versions of Zope 4 and Zope 5 are affected. Patches will be released wit...