WoodMart < 7.1.2 - License Update/Deactivation via CSRF

The theme does not have CSRF checks when updating and deactivating the license, which could allow attackers to make logged in admins perform such actions via CSRF attacks To deactivate the license...

D-Link DIR-2150 <= 4.0.1 Multiple Vulnerabilities

D-Link DIR-2150 devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Music Gallery Site 1.0 SQL Injection Vulnerability

Music Gallery Site - SQL Injection on page musiclist.php and parameter cid is vulnerable, application url is ?page=musiclist&cid=?. Any remote attacker can access this page to exploit the vulnerbility. CVE Assigned: CVE-2023-0938 mitre.org nvd.nist.org Author Name: Muhammad Navaid Zafar Ansari...

Fortinet FortiWeb has an unspecified vulnerability (CNVD-2023-18296)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A security vulnerability exists that could b...

Simple Food Ordering System 1.0 Cross Site Scripting Vulnerability

Simple Food Ordering System - Authenticated Reflected Cross Site Scripting CVE Assigned: CVE-2023-0902 mitre.org nvd.nist.org Author Email: navaidnemail protected Vendor Homepage: https://www.sourcecodester.com Software Link: Simple Food Ordering System Version: v 1.0 What is Reflected Cross-Site...

Online Pet Shop We App 跨站脚本漏洞

Online Pet Shop We App is an online pet store web application by Carlo Montero Personal Developer. A cross-site scripting vulnerability exists in SourceCodester Online Pet Shop We App version 1.0, which stems from the fact that incorrect manipulation of the parameter oid can lead to cross-site...

UI REDRESSING

Description The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with Steps To Reproduce 1. Create a New HTML file as shown in below i....

Music Gallery Site 1.0 SQL Injection

Music Gallery Site - SQL Injection on page musiclist.php and parameter cid is vulnerable, application url is ?page=musiclist&cid=?. Any remote attacker can access this page to exploit the vulnerbility. Date: 21 February 2023 CVE Assigned: CVE-2023-0938 mitre.org nvd.nist.org Author Name: Muhammad...

Medical Certificate Generator App 跨站脚本漏洞

The Medical Certificate Generator App is a simple web application for medical clinics. A cross-site scripting vulnerability exists in SourceCodester Medical Certificate Generator App version 1.0, which stems from incorrect manipulation of a special parameter that results in cross-site scripting...

Employee Task Management System 1.0 SQL Injection

Employee Task Management System - SQL Injection on task-details.php?taskid=? with low privilege authentication Date: 17 February 2023 CVE Assigned: CVE-2023-0904 mitre.org, nvd.nist.org Author Email: [email protected] Vendor Homepage: https://www.sourcecodester.com Software Link: Employe...

PT-2023-3640 · Sage · Sage X3

Name of the Vulnerable Software and Affected Versions: Sage X3 version 12.14.0.50-0 Description: The issue is related to Cross Site Scripting XSS in the Sage X3 Web application. Some parts of the application are dynamically built using user inputs, but these inputs are not verified or filtered,...

Cross-Site Scripting (Stored/Persistent) in Categories

Description • The application is vulnerable to Cross-Site Scripting XSS attacks. This occurs when web applications do not properly validate user-supplied inputs before including them in dynamic web pages. • By intercepting the HTTP Request using Burp-suite tool before submitting into the webpage,...

CVE-2023-0867

OpenNMS Meridian and Horizon are affected by multiple stored and reflected cross-site scripting (XSS) vulnerabilities in webapp jsp pages. The root cause involves insecure handling in the web-facing components, exposing the potential to access confidential session information. Affected software i...

The Secret Vulnerability Finance Execs are Missing

The Other Risk in Finance A few years ago, a Washington-based real estate developer received a document link from First American – a financial services company in the real estate industry – relating to a deal he was working on. Everything about the document was perfectly fine and normal. The odd...

Fortinet FortiWeb 安全漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A security vulnerability exists that could b...

CVE-2022-41565

The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the affected system. Affected releases are...

Gcore Thwarts Massive 650 Gbps DDoS Attack on Free Plan Client

At the beginning of January, Gcore faced an incident involving several L3/L4 DDoS attacks with a peak volume of 650 Gbps. Attackers exploited over 2000 servers belonging to one of the top three cloud providers worldwide and targeted a client who was using a free CDN plan. However, due to Gcore's...

PT-2023-13991 · Tibco Software · Tibco Product/Service Catalog +1

Name of the Vulnerable Software and Affected Versions: TIBCO EBX versions 5.9.21 and below TIBCO EBX versions 6.0.11 and below TIBCO Product and Service Catalog powered by TIBCO EBX versions 1.2.0 and below Description: The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO...

CVE-2022-41565 TIBCO EBX Cross Site Scripting (XSS) Vulnerability

The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a stored XSS on the affected system. Affected releases are...

Joomla! 4.0.0 < 4.2.8 Broken Access Control

A broken access control allows unauthorized access to webservice endpoints allowing access to sensitive information such as database login information. No source data...