CVE-2023-33584

Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection SQLI attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the username and password fields during the login process...

Cross-Site Scripting (XSS)

github.com/gitpod-io/gitpod is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly check for user input URLs which leads to redirection for some protocols outside of the trusted set of three vscode: vscode-insiders: jetbrains-gateway:, allowing an attacker to execute...

Cross-Site Scripting (XSS)

admidio/admidio is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to a lack of user input sanitization in this library. which allows an attacker to inject and execute arbitrary JavaScript into the browser...

PT-2023-3405 · NetGear · Netgear R6250

Name of the Vulnerable Software and Affected Versions: Netgear R6250 Firmware Version 1.0.4.48 Description: The issue is related to a buffer overflow vulnerability in the Netgear R6250 router's firmware. This vulnerability is associated with uncontrolled copying of user input, which can lead to a...

CVE-2023-2399

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...

CVE-2023-2399 qubotchat < 1.1.6 - Unauthenticated Stored XSS

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...

CVE-2023-2399 qubotchat < 1.1.6 - Unauthenticated Stored XSS

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...

ROS-20230619-02

A vulnerability in the Redis database is related to insufficient validation of user-entered data, a user could use the HINCRBYFLOAT command to create an invalid hash field. Exploitation of the vulnerability could allow an attacker acting remotely to cause Redis to crash when accessing the affecte...

Stored XSS on user "Category report" function

Description An attacker can inject malicious executable scripts into the code of the Name field Proof of Concept Log in as an admin or any member with the right access to the Category report - Configuration function. Insert this payload into the "Name" field General role assignment" autofocus...

PT-2023-24002 · Thinking · Thinking Software Efence

Name of the Vulnerable Software and Affected Versions: Thinking Software Efence affected versions not specified Description: The issue is related to insufficient validation for user input in the login function, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. This can...

Code Injection

nuxt is vulnerable to Code Injection. The vulnerability exists due to a lack of user input path validation in test-component-wrapper.ts which allows an attacker to inject and execute malicious code. Note that this vulnerability is only applicable if the server is ran on dev mode...

Denial Of Service (DoS)

org.codehaus.janino:janino is vulnerable to Denial of Service DoS attacks. The vulnerability is due to the guessParameterNames method caused to an uncaught stack overflow exception, which can be triggered by user input with deeply nested structures causing the application to crash...

CVE-2023-25367

Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...

Cross site scripting

SAP UI5 Variant Management - versions SAPUI 750, SAPUI 754, SAPUI 755, SAPUI 756, SAPUI 757, UI700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting Stored XSS vulnerability. After successful exploitation, an attacke...

CVE-2023-33991 Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management

SAP UI5 Variant Management - versions SAPUI 750, SAPUI 754, SAPUI 755, SAPUI 756, SAPUI 757, UI700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting Stored XSS vulnerability. After successful exploitation, an attacke...

CVE-2023-33986 Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management)

SAP CRM ABAP Grantor Management - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the applicatio...

WordPress Plugin Page Builder: KingComposer Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Page Builder: KingComposer, which is caused by incorrect validation of...

EulerOS Virtualization 3.0.6.0 : ruby (EulerOS-SA-2023-2248)

According to the versions of the ruby package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to...

HTML Injection

teampass password manager is vulnerable to HTML injection .The vulnerability is due to lack of user input sanitisation while renaming a folder with user supplied folder name resulting in running malicious html when the same folder is accessed by other users including admin...

GHSA-QMW8-X364-XXXM Teampass Cross-site Scripting vulnerability

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting XSS vectors in the application...