Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via crafted filenames in the myviewpage.php Timeline feature. An attacker can execute arbitrary code visible to any user viewing the My View Page by uploading an...

GHSA-GG4J-279J-22PH MantisBT allows cross-site scripting (XSS) via crafted filename

The Timeline feature in myviewpage.php in MantisBT through 2.21.1 has a stored cross-site scripting XSS vulnerability, allowing execution of arbitrary code if CSP settings permit it after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the...

MantisBT allows cross-site scripting (XSS) via crafted filename

The Timeline feature in myviewpage.php in MantisBT through 2.21.1 has a stored cross-site scripting XSS vulnerability, allowing execution of arbitrary code if CSP settings permit it after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the...

GHSA-8R2M-QHFF-JM2C MantisBT XSS via my_view_page.php and view_user_page.php

A cross-site scripting XSS vulnerability in the MantisBT 2.3.x before 2.3.2 Timeline include page, used in My View myviewpage.php and User Information viewuserpage.php pages, allows remote attackers to inject arbitrary code if CSP settings permit it through crafted PATHINFO in a URL, due to use o...

CVE-2022-29983

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/viewinvoice&id=...

CVE-2022-25223

Money Transfer Management System Version 1.0 allows an authenticated user to inject SQL queries in 'mtms/admin/?page=transaction/viewdetails' via the 'id' parameter...

Cross site scripting

SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page...

Solarwinds Orion Platform 跨站脚本漏洞

SolarWinds Orion Platform is a comprehensive bandwidth performance management and fault management application that lets you view real-time statistics about your network directly from your Web browser. A stored cross-site scripting vulnerability exists in SolarWinds Orion Platform versions prior ...

MantisBT Information Disclosure Vulnerability (CNVD-2021-00827)

MantisBT is a lightweight, free and open source, web-based defect tracking system. An information disclosure vulnerability exists in MantisBT versions prior to 2.24.4. The vulnerability stems from a failure to check access to bugrevisionviewpage.php correctly. An attacker can exploit the...

h1-ctf: Hacky Holidays Writeup

On December 12th, 2020, the CTF became live and the scope that we are allowed to attack was In Scope Domain - hackyholidays.h1ctf.com Our main motive was to infiltrate his network and take him down. The challenges appeared one by one till 24th of December. Here we will be going through all the...

Chun technical blog team easy enterprise show integration 70C scene show source code system has unauthorized access vulnerability

Chun brother technology blog team is committed to sharing station building technology, micro letter development technology, custom development business source code system, custom development enterprise website, is a service small and medium-sized webmaster enterprise technology-based independent...

DEBIAN-CVE-2019-7344

Reflected XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code in the view 'filter' as it insecurely prints the 'filterName' aka Filter name value on the web page without applying any proper filtration...

DEBIAN-CVE-2019-7351

Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value...

CVE-2019-7351

Log Injection exists in ZoneMinder through 1.32.3, as an attacker can entice the victim to visit a specially crafted link, which in turn will inject a custom Log message provided by the attacker in the 'log' view page, as demonstrated by the message=User%20'admin'%20Logged%20in value...

PT-2019-18531 · Zoneminder +3 · Zoneminder +3

Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.32.4 Description: A Self-Stored Cross Site Scripting XSS issue exists, allowing an attacker to execute HTML or JavaScript code via a vulnerable Host parameter value in the view console console.php, specifically...

UBUNTU-CVE-2018-14954

The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute...

Cross site scripting

A stored Cross-site Scripting XSS vulnerability in Fortinet FortiWeb webUI Certificate View page in 5.8.0, 5.7.1 and earlier, allows attackers to inject arbitrary web script or HTML via special crafted malicious certificate import...

Basic B2B Script SQL Injection Vulnerability

Basic B2B Script is a B2B e-commerce website system. A SQL injection vulnerability exists in Basic B2B Script. The vulnerability can be exploited by remote attackers to inject SQL commands by sending 'pid' or 'id' parameters to the productview1.php file...

vrpspeed.com XSS vulnerability

Vulnerable URL:...

SQL Injection Vulnerability in News_view.asp Page of Ningbo Yuming Website Building System

Ningbo Yuming Network Station Building System is an enterprise station building system. There is a SQL injection vulnerability in the newsview.asp page of Ningbo Yuming Network System, which can be exploited by attackers to obtain sensitive information from the database...