518 matches found
CVE-2023-48834
A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion...
Privilege escalation
A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion...
CVE-2023-48835
CVE-2023-48835 affects Car Rental Script v3.0; the vulnerability is a CSV Injection in the Language > Labels > Export action due to insufficient input validation on the Unique ID field in Reservations. Impact is high (C:H, I:H, A:H) with CVSS 3.1 base score 8.8. In-the-wild/exploit details ...
CVE-2023-48834
CVE-2023-48834 affects Car Rental Script v3.0, caused by a missing rate limit in the function pjActionAjaxSend, enabling unauthenticated attackers to exhaust resources over the network. Exploitation context is supported by multiple sources (e.g., PT-Security guidance and public writeups). Remedia...
Cross site scripting
Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...
CVE-2023-45394
Stored Cross-Site Scripting XSS vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover...
CVE-2023-45394
The CVE-2023-45394 issue affects Small CRM v3.0, described as a Stored Cross-Site Scripting (XSS) vulnerability in the Company field of the "Request a Quote" section. The root cause is unsafely handling input in that field, enabling an attacker to store and execute malicious JavaScript in the Adm...
CVE-2023-44075
Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the Address parameter...
CVE-2023-43331
A cross-site scripting XSS vulnerability in the Add User function of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...
CVE-2023-43331
CVE-2023-43331 is an XSS in the Add User function of Small CRM v3.0, exploited by injecting crafted payloads into the Name field. Affected: Small CRM v3.0 (Add User/Name field). Root cause: inadequate input sanitization leading to script/HTML execution. Public metrics indicate CVSS v3.1 base scor...
CVE-2023-40930
An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/...
CVE-2023-40930
An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/...
CVE-2023-40930
An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/...
Directory traversal
An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/...
CVE-2023-40930
An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/...
CVE-2023-40930
An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mnt/...
Stack overflow
Tenda AC9 V3.0 V15.03.06.42multi was discovered to contain a stack overflow via parameter firewallEn at url /goform/SetFirewallCfg...
CVE-2023-41563
Tenda AC9 V3.0 V15.03.06.42multi and Tenda AC5 USAC5V1.0RTLV15.03.06.28 were discovered to contain a stack overflow via parameter mac at url /goform/GetParentControlInfo...
CVE-2023-41554
CVE-2023-41554 affects Tenda AC9 (V3.0, V15.03.06.42_multi). The vulnerability is a stack overflow in the wpapsk_crypto parameter on the /goform/WifiExtraSet API, causing potential remote impact over the network with high likelihood of impact to confidentiality, integrity, and availability. Publi...