Simple Online Mens Salon Management System Cross-Site Scripting Vulnerability

Simple Online Mens Salon Management System is open source a men's salon management system . Simple Online Mens Salon Management System v1.0 version of a cross-site scripting vulnerability , the vulnerability stems from the file /admin/?page=user/list parameter First Name/Last Name/Username on the...

Code injection

The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering...

Moxa IKS, EDS Improper Neutralization of Input During Web Page Generation (CVE-2019-6565)

Moxa IKS and EDS fails to properly validate user input, giving unauthenticated and authenticated attackers the ability to perform XSS attacks, which may be used to send a malicious script. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

WordPress Checkout Field Editor (Checkout Manager) for WooCommerce Plugin < 1.8.0 PHP Object Injection Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:themehigh:checkoutfieldeditorforwoocommerce"; if description...

Moxa AWK-3131A Series Industrial AP/Bridge/Client Improper Neutralization of Special Elements Used in an OS Command (CVE-2019-5141)

An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iwserverip parameter can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. An attacker can...

PT-2023-25432

Name of the Vulnerable Software and Affected Versions Faculty Evaulation System version 1.0 Description The issue allows an attacker to execute arbitrary code via a crafted payload to the page parameter. This is a Cross Site Scripting vulnerability in the Faculty Evaulation System using PHP/MySQL...

CVE-2023-34635

Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in the username field of the login page...

CVE-2023-34635

Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. The vulnerability occurs because of not validating or sanitizing the user input in the username field of the login page...

Stored Cross-Site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Stored Cross-Site Scripting XSS attacks. This vulnerability allows an attackers to target other users or administrators and gain control of their accounts via executing malicious JavaScript on victim's session due to insufficient user input validations...

Cross-Site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the user input before it output to the front end, allowing an attacker to inject and execute malicious javascript on victim's browser, which leads to potential account takeover...

Security Bulletin:IBM TRIRIGA Application Platform discloses cross-site scripting (CVE-2022-24620)

Summary CVE-2022-24620 Piwigo is vulnerable to cross-site scipting Vulnerability Details IBM X-Force ID: 87544 DESCRIPTION: Piwigo is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the admin.php script. A remote attacker could exploit this vulnerabilit...

CVE-2023-39017

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that...

Command Injection

paddlepaddle is vulnerable to command injection. The vulnerability exists due to a lack of user input validation in the system parameter of fs.py which allows an attacker to inject arbitrary commands into the operating system...

CVE-2023-39017

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that...

CVE-2023-39017

Removed by vendor...

Arbitrary File Write

pandoc is vulnerable to Arbitrary File Write. By providing a constructed picture element as input while creating files with the --extract-media option or outputting to PDF format, an arbitrary file write vulnerability may be exploited. This vulnerability affects systems that enable pandoc to outp...

Cross-Site Scripting (XSS)

copyparty is vulnerable to Cross-Site Scripting. The vulnerability exists due to a lack of user input validation in the ?k304= and ?setck= parameters which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Debian: Security Advisory (DLA-3502-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-site Scripting (XSS)

pimcore/pimcore is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the link.js which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Cross-site Scripting (XSS)

nilsteampassnet/teampass is vulnerable to stored Cross-site Scripting XSS. The vulnerability exists in Default session expiration time due to improper user-input sanitization which allows an attacker to inject and execute arbitrary javascript or html code...