Bug Finder ChainCity Real Estate Investment Platform 跨站脚本漏洞

Bug Finder ChainCity Real Estate Investment Platform is a real estate investment platform from Bug Finder, Inc. A cross-site scripting vulnerability exists in version 1.0 of the ChainCity Real Estate Investment Platform, which stems from the cross-site scripting caused by the parameter subject in...

HackerOne: HackerOne Support System Doesn't Require Any Authentication May Lead Unauthorized Action

The HackerOne support system did not require any authentication, allowing anyone to open a support ticket for another user's account. This could potentially lead to unauthorized actions being taken on the account...

Groundhogg < 2.7.8.9 - Ticket Creation via CSRF

The plugin does not have CSRF check when creating a support ticket to the plugin author, which could allow attackers to make logged-in admins perform such action via a CSRF attack...

TikTok: CSRF in ticket function

A cross-site request forgery CSRF vulnerability was found on a TikTok Shop endpoint, which could have resulted in the arbitrary creation of tickets. The vulnerability was reported by @ibrahim0936356 to the TikTok team...

SUSE CVE-2014-1694

Multiple cross-site request forgery CSRF vulnerabilities in 1 CustomerPreferences.pm, 2 CustomerTicketMessage.pm, 3 CustomerTicketProcess.pm, and 4 CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System OTRS 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow...

Stored XSS

Description A Cross-Site Scripting XSS vulnerability exists in Dolibarr before 16.0.4 via the ticket creation flow. Exploitation requires that an admin change the value of the box using "onbeforeinput" event. In the worst case, the victim who inadvertently triggers the attack is a highly privileg...

Stored XSS - Entity name not sanitize in Ticket creation page

Description An Administrator can set a Cross-Site Scripting XSS payload inside an entity name. This XSS will be executed on the Ticket Creation page Menu - Assistance - Create Ticket. Proof of Concept 1. Set an XSS in Entity name 2. Go to the "Create Ticket" page 3. XSS is excuted...

The Mail Handler creates tickets from incoming emails in the wrong projects

The mail handler in Jira Service Management JSM Server and Data Center 4.22.5 incorrectly maps new incoming emails to the wrong JSM project, instead of the project linked to the mailbox the mails were sent to. If JSM is configured to process emails and create tickets in a restricted-access projec...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

Arbitrary file deletion

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue Note: the ticket-creation page is the one with the wpsccreateticket shortcode embed...

GHSA-JQFP-M5F8-VG28 Dolibarr Cross Site Scripting (XSS) vulnerability

A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...

CVE-2021-42220

A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...

CVE-2021-42220

A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...

UBUNTU-CVE-2021-42220

A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...

CVE-2021-42220

A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...

CVE-2021-42220

A Cross Site Scripting XSS vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box...

Small CRM 3.0 Cross Site Scripting

Exploit Title: Small CRM 3.0 - 'description' Stored Cross-Site Scripting XSS Date: 20/10/2021 Exploit Author: Ghuliev Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/small-crm-php/ Version: 3.0 Tested on: Server: Ubuntu When a user or admin creates a ticket, we can...