Hospitals Patient Records Management System 1.0 - (id) SQL Injection (Authenticated) Vulnerability

Exploit Title: Hospitalss Patient Records Management System 1.0 - 'id' SQL Injection Authenticated Exploit Author: twseptian Vendor Homepage: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html Software Link:...

Hospitals Patient Records Management System 1.0 - Account TakeOver Vulnerability

Exploit Title: Hospitals Patient Records Management System 1.0 - Account TakeOver Exploit Author: twseptian Vendor Homepage: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html Software Link:...

CMSimple 5.4 - Cross Site Scripting Vulnerability

Exploit Title: CMSimple 5.4 - Cross Site Scripting XSS Exploit Author: heinjame Vendor Homepage: https://www.cmsimple.org/en/ Software Link: https://www.cmsimple.org/en/?Downloads Version: images Upload a file Attack vector '-alert1// need to encode ' When the victim clicks the delete button,an...

CMSimple 5.4 - Cross Site Scripting (XSS)

Exploit Title: CMSimple 5.4 - Cross Site Scripting XSS Date: 22/10/2021 Exploit Author: heinjame Vendor Homepage: https://www.cmsimple.org/en/ Software Link: https://www.cmsimple.org/en/?Downloads Version: images Upload a file Attack vector '-alert1// need to encode ' When the victim clicks the...

Microsoft Sees Rampant Log4j Exploit Attempts, Testing

No surprise here: The holidays bought no Log4Shell relief. Threat actors vigorously launched exploit attempts and testing during the last weeks of December, Microsoft said on Monday, in the latest update to its landing page and guidance around the flaws in Apache’s Log4j logging library. “We have...

CVE-2021-39143

Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system...

Path traversal

Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system...

Google Chrome Web Storage Bypass

The vulnerability of Google Chrome browser-based web storage is caused by synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to bypass existing security restrictions remotely...

Nordaaker Convos Cross-site Scripting Vulnerability

Nordaaker Convos is an open source web browser-based multi-user chat application from Nordaaker, Norway. A cross-site scripting vulnerability exists in Nordaaker Convos, which stems from a problem with the software's restrictions on files with SVG extensions. An attacker can upload files with the...

UBUNTU-CVE-2021-45930

Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps::growAppend called from QPainterPath::addPath and QPathClipper::intersect...

afwizard (1.0.1), frontpy (>=0.1.6, <=0.1.14) +4 more potentially affected by CVE-2021-45943 via gdal (>=3.3.2, <=3.4.0)

gdal PYPI version =3.3.2, =0.1.6, =0.1.1, =0.1.0, =0.2.4, =0.1.3, =0.1.4 Source cves: CVE-2021-45943 Source advisory: OSV:PYSEC-2022-43065...

Digia Qt buffer error vulnerability

Digia Qt is a cross-platform C++ application development framework from Digia Finland. The framework can be used to develop GUI programs. A buffer error vulnerability exists in Qt SVG in Digia Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1, which stems from an out-of-bounds write in...

Netgear RAX43 buffer error vulnerability

The Netgear RAX43 is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between them. A buffer overflow vulnerability exists in Netgear RAX43 version 1.0.3.96. The vulnerability is caused by the URL parsing functionality of the...

Adobe After Effects Heap Buffer Overflow

The vulnerability of Adobe After Effects’ video and dynamic image editing software relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2021-45696

An issue was discovered in the sha2 crate 0.9.7 before 0.9.8 for Rust. Hashes of long messages may be incorrect when the AVX2-accelerated backend is used...

Wiki.js cross-site scripting vulnerabilities

Wiki.js is a suite of open source Wiki software based on Node.js and written in JavaScript by the Requarks.io team. Requarks Wiki.js suffers from a cross-site scripting vulnerability that stems from a script that uploads SVG files through a custom request using a forged MIME type. By creating a...

Brave Software: New XSS vector in ReaderMode with %READER-TITLE-NONCE%

A new XSS vulnerability was discovered in Brave iOS 1.31.1 and higher, which allowed attackers to execute malicious scripts on ReaderMode pages. The vulnerability was caused by a relaxation of the CSP rule, which allowed scripts with nonce-%READER-TITLE-NONCE% to be executed. Attackers could...

CVE-2021-4052

Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension...

UBUNTU-CVE-2021-45267

An invalid memory address dereference vulnerability exists in gpac 1.1.0 via the svgnodestart function, which causes a segmentation fault and application crash...

PT-2022-11994 · Spip +2 · Spip +2

Name of the Vulnerable Software and Affected Versions: SPIP version 4.0.0 Description: The issue allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users. This is achieved by exploiting a Cross Site Scripting XSS vulnerability, whe...