CVE-2021-42137

An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc...

Privilege escalation

An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list of tickets that shows title, state, etc...

CVE-2021-42137

Summary of CVE-2021-42137 (Zammad): Zammad before 5.0.1 contains an authorization flaw that improperly enforces privilege requirements when viewing a list of tickets (shows title, state, etc.). This affects versions prior to 5.0.1 and arises from insufficient access control. Reported across multi...

Zammad 安全漏洞

Zammad is a suite of ticket management software from Zammad, a German company. Zammad is vulnerable to authorization issues in versions prior to 5.0.1, which stem from a lack of authentication measures or insufficient authentication strength in the network system or product. An attacker could use...

Zammad Information Disclosure Vulnerability (CNVD-2021-81948)

Zammad is a ticket management software from Zammad, a German company. versions prior to Zammad 4.1.1 have security vulnerabilities that allow attackers to discover application secrets and obtain sensitive information through the API...

Dolibarr ERP / CRM 14.0.2 Cross Site Scripting / Privilege Escalation

Exploit Title: Dolibarr ERP & CRM v14.0.2 Stored XSS / Privilege Escalation Exploit Author: Oscar Gutierrez m4xp0w3r Date: October 9, 2021 Vendor Homepage: https://www.dolibarr.org/ Software Link: https://github.com/Dolibarr Tested on: Ubuntu, LAAMP Vendor: Dolibarr Version: v14.0.2 Exploit...

Dolibarr ERP / CRM 14.0.2 Cross Site Scripting / Privilege Escalation Vulnerabilities

Dolibarr ERP and CRM 14.0.2 suffers from a persistent cross site scripting vulnerability that enables privilege escalation. Exploit Title: Dolibarr ERP & CRM v14.0.2 Stored XSS / Privilege Escalation Exploit Author: Oscar Gutierrez m4xp0w3r Vendor Homepage: https://www.dolibarr.org/ Software Link...

CVE-2021-42092

An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket...

CVE-2021-42092

An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket...

Cross site scripting

An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket...

CVE-2021-42092

An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket...

CVE-2021-42092

The CVE-2021-42092 issue affects Zammad prior to 4.1.1, where a Stored XSS can be triggered when attaching a file to a Ticket via an Article. The root cause is input validation/escaping during attachment handling that allows injected JavaScript to be stored and later executed in the context of th...

Zammad 安全漏洞

Zammad is a ticket management software from Zammad, a German company. versions prior to Zammad 4.1.1 have security vulnerabilities that allow attackers to discover application secrets and obtain sensitive information through the API...

WP Ticket < 5.10.4 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Navigate to WP Ticket Forms edit layout of "Open a Ticket" or "Search...

WordPress WP Ticket plugin <= 5.10.3 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Tri Wanda Septian in WordPress WP Ticket plugin versions = 5.10.3. Solution Update the WordPress WP Ticket plugin to the latest available version at least 5.10.4...

CVE-2021-24623

The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability i...

Cross site scripting

The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability i...

CVE-2021-24623 WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS)

The WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin before 1.0.64 does not sanitize or escape form values before saving to the database or when outputting, which allows high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability i...

CVE-2021-24623

CVE-2021-24623 affects the WordPress Advanced Ticket System, Elite Support Helpdesk WordPress plugin prior to version 1.0.64. The vulnerability arises because the plugin does not sanitize or escape form values before saving to the database or outputting, enabling authenticated users with high pri...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the WordPress plugin WordPress Advanced Ticket System, Elite Support...