CVE-2021-43437

Technical details, affected versions, exploit methods, and fixes for CVE-2021-43437 are not publicly provided in the supplied documents; monitor official advisories for updates.

Cross-site Scripting (XSS) - Stored in polonel/trudesk

Description There are several areas in the web application that are vulnerable to stored XSS. They include: The chat feature when sending messages /messages/startconversation The name field when creating a department /departments Name field when creating teams /teams You can also exploit the XSS...

Mattermost Input Validation Error Vulnerability (CNVD-2022-08350)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost 6.0 and earlier versions, which can be exploited by an authenticated attacker to cause a WEB application client to crash via a maliciously crafted post...

Engineers Online Portal 注入漏洞

Engineers Online Portal is open source an online portal . It is developed using PHP, MySQL database, HTML, CSS, Javascript, jQuery, Ajax, Bootstrap and some other libraries. A security vulnerability exists in Engineers Online Portal, which stems from the lack of protection and authentication of t...

phpKF CMS 3.00 Beta y6 - Remote Code Execution (Unauthenticated) Exploit

Exploit Title: phpKF CMS 3.00 Beta y6 - Remote Code Execution RCE Unauthenticated Exploit Author: Halit AKAYDIN hLtAkydn Vendor Homepage: https://www.phpkf.com/ Software Link: https://www.phpkf.com/indirme.php Version: 3.00 Category: Webapps Tested on: Linux/Windows phpKF-CMS; It is a very popula...

Galette SQL Injection Vulnerability

Galette is a membership management web application built for non-profit organizations and released under the GPLv3. A SQL injection vulnerability exists in versions of Galette prior to 0.9.6. An attacker with "member" privileges could use this vulnerability to launch an SQL injection attack...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Description XSS in Classification Store included panels like Collections, Groups, Key,... in the store Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web...

Design/Logic Flaw

This affects the package unisharp/laravel-filemanager from 0.0.0. The upload function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: - Install a package with a web Laravel application. - Navigate to the Upload window - Upload...

CVE-2021-37863

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post...

CVE-2021-37863

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post...

Code injection

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post...

CVE-2021-37863

Mattermost 6.0 and earlier are affected by an input validation issue during post creation. The vulnerability allows an authenticated attacker to trigger a client-side crash of the web app via a maliciously crafted post. Public sources consistently describe the issue as arising from insufficient v...

CVE-2021-37863

Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2022-04999)

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...

ThinkPHP SQL Injection Vulnerability (CNVD-2021-103660)

ThinkPHP is a set of PHP-based, open source, lightweight Web application development framework from China Top Think Information Technology. thinkPHP has SQL injection vulnerability, there is no detailed vulnerability details provided...

Adobe Experience Manager Cross-Site Scripting Vulnerability

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...

Online Magazine Management System SQL Injection Vulnerability

Online Magazine Management System is an open source PHP-based web application where users can share their magazines. Online Magazine Management System is vulnerable to SQL injection, which can be exploited by attackers to gain access to the application as an administrator...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2021-102798)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Galette Cross-Site Request Forgery Vulnerability

Galette is open source a membership management web application for non-profit organizations. Galette suffers from a cross-site request forgery vulnerability that stems from a failure to check for cross-site request forgery attacks in Galette version 0.9.6 and earlier. No details of the...

laravel-filemanager 代码问题漏洞

laravel-filemanager is an open source tool from UniSharp. A code issue vulnerability exists in laravel-filemanager that stems from the upload function not adequately validating the file type during upload. An attacker can replicate the following steps to exploit the vulnerability:Install a packag...