CVE-2024-37160: Improper Neutralization of Input During Web Page Generation

Formwork is a flat file-based Content Management System CMS. An attackers requires administrator privilege to execute arbitrary web scripts by modifying site options via /panel/options/site. This type of attack is suitable for persistence, affecting visitors across all pages except the dashboard...

Reflected Cross Site Scripting (XSS)

dolibarr/dolibarr is vulnerable to a Reflected Cross-site Scripting XSS. The vulnerability is due to improper input validation in htdocs/compta/paiement/card.php, allowing remote attackers to inject arbitrary web script or HTML via the facid parameter...

GHSA-HV2J-6654-X74Q Reflected Cross-Site Scripting (XSS) in Dolibarr

A Reflected Cross-site scripting XSS vulnerability located in htdocs/compta/paiement/card.php of Dolibarr before 19.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the facid parameter...

PT-2024-29456

Name of the Vulnerable Software and Affected Versions Download Manager plugin for WordPress versions up to, and including, 3.2.90 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wpdm-all-packages shortcode. This allows...

JFinalCMS Cross-Site Scripting Vulnerability (CNVD-2024-26516)

JFinalCMS is a content management system. JFinalCMS 20221020 and previous versions of cross-site scripting vulnerability, the vulnerability stems from the file /admin/content parameter Title of the user-supplied data lack of effective filtering and escaping, an attacker can use this vulnerability...

IBM Engineering Workflow Management Cross-Site Scripting Vulnerability (CNVD-2024-25255)

IBM Engineering Workflow Management is an enterprise-level engineering workflow management system that provides process management, task assignment, and more. A cross-site scripting vulnerability exists in IBM Engineering Workflow Management versions 7.0.2 and 7.0.3 that stems from insufficient...

Laboratory Management System security vulnerabilities

Laboratory Management System is a laboratory management system by oretnom23 individual developer. A security vulnerability exists in Laboratory Management System v1.0. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a specially crafted payload injected into...

WBSAirback cross-site scripting vulnerability (CNVD-2024-27119)

WBSAirback is a next generation storage and backup system from WBSAirback. A cross-site scripting vulnerability exists in WBSAirback version 21.02.04, which can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a crafted payload...

CVE-2024-3066

The Elegant Addons for elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping on user supplied tag attributes. This makes it possible for...

TOTOLINK X2000R Cross-Site Scripting Vulnerability

TOTOLINK X2000R is a WiFi6 wireless router from China's Gion Electronics TOTOLINK that supports Gigabit network and EasyMesh function with multi-device connectivity and wireless expansion capability. The TOTOLINK X2000R suffers from a cross-site scripting vulnerability that stems from the...

CVE-2024-33528

A Stored Cross-site Scripting (XSS) vulnerability exists in the ILIAS learning management system, affecting versions 7.0.0 through 7.29 and 8.0.0 through 8.10 . The root cause is the improper neutralization of input during web page generation, which allows remote authenticated attackers with tuto...

Cybozu Garoon cross-site scripting vulnerability (CNVD-2024-29671)

Cybozu Garoon is a portal-type OA office system from Cybozu Japan. The system provides portal, e-mail, bookmarks, scheduling, bulletin board, document management, and other functions. A cross-site scripting vulnerability exists in Cybozu Garoon. The vulnerability stems from the application's lack...

CVE-2024-34224

Cross Site Scripting vulnerability in /php-lms/classes/Users.php?f=save in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the firstname, middlename, lastname parameters...

CVE-2024-34225

Cross Site Scripting vulnerability in php-lms/admin/?page=systeminfo in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the name, shortname parameters...

CVE-2024-34224

The Computer Laboratory Management System using PHP and MySQL 1.0 (specifically version 1.0) is vulnerable to a Cross Site Scripting (XSS) flaw. The vulnerability exists in the /php-lms/classes/Users.php?f=save endpoint, where the application fails to properly neutralize the firstname , middlenam...

Cross-site Scripting (XSS)

Buildbot is vulnerable to a cross-site scripting XSS. The vulnerability is due to improper santization within the waterfall web status view status/web/waterfall.py, enabling remote attackers to inject arbitrary web script or HTML...

Cross-site Scripting (XSS)

Buildbot is vulnerable to Cross-Site Scripting XSS vulnerabilities. The vulnerability is due to improper sanitization, allowing remote attackers to inject arbitrary web script or HTML...

Dell OpenManage Enterprise Cross-Site Scripting Vulnerability

Dell OpenManage Enterprise is an easy-to-use, one-to-many systems management console for IT infrastructure management from Dell. The software supports cost-effective, comprehensive lifecycle management of Dell EMC PowerEdge servers from a single console. A cross-site scripting vulnerability exist...

CVE-2024-3729

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'feaencrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can ...

CVE-2024-3729

The CVE-2024-3729 issue affects the Frontend Admin by DynamiApps WordPress plugin. It is caused by improper missing encryption exception handling in the fea_encrypt function, and is exploitable on all versions up to and including 3.19.4 when the OpenSSL PHP extension is not loaded. This allows un...