backinmotion.com.au Cross Site Scripting vulnerability OBB-3855963

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

playterritory.com Cross Site Scripting vulnerability OBB-3855768

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-1081

The 3D FlipBook – PDF Flipbook WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bookmark feature in all versions up to, and including, 1.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2024-25603

The CVE-2024-25603 issue affects Liferay Portal and Liferay DXP where a stored XSS flaw exists in the Dynamic Data Mapping (DDMForm) component. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter. Affected versions include Portal...

WEBIGniter 28.7.23 Cross Site Scripting

Exploit Title: WEBIGniter v28.7.23 Stored Cross Site Scripting XSS Exploit Author: Sagar Banwa Date: 19/10/2023 Vendor: https://webigniter.net/ Software: https://webigniter.net/demo Reference: https://portswigger.net/web-security/cross-site-scripting Tested on: Windows 10/Kali Linux CVE :...

CVE-2022-45169

CVE-2022-45169 affects LIVEBOX Collaboration vDesk (through v031). It describes an Open Redirect: an authenticated user can trigger a URL redirection via /api/v1/notification/createnotification to send a push notification to another user that can include an invisible clickable link. Reported metr...

CVE-2024-25895

CVE-2024-25895 affects ChurchCRM 5.5.0. The vulnerability is a reflected cross-site scripting (XSS) in the /EventAttendance.php endpoint, exploitable via the type parameter. The underlying cause is improper handling of user-supplied input in that parameter, allowing an attacker to inject arbitrar...

CVE-2024-0656

CVE-2024-0656 affects the Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease for WordPress, all versions up to 2.6.6. It enables Stored XSS via the Google Captcha Site Key due to insufficient input sanitization/output escaping. Exploitation requires administ...

Savsoft Quiz 6.0 Enterprise Cross Site Scripting

Exploit Title: Savsoft Quiz v6.0 Enterprise - Persistent Cross-Site Scripting Date: 2024-01-03 Exploit Author: Eren Sen Vendor: SAVSOFT QUIZ Vendor Homepage: https://savsoftquiz.com Software Link: https://savsoftquiz.com/web/index.php/online-demo/ Version: 6.0 CVE-ID: N/A Tested on: Kali Linux /...

SPA-CART CMS 1.9.0.3 Cross Site Scripting

Exploit Title: SPA-CART CMS - Stored XSS Date: 2024-01-03 Exploit Author: Eren Sen Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/ Version: 1.9.0.3 CVE-ID: N/A Tested on: Kali Linux / Windows 10 Vulnerabilities Discovered Date : 2024/01/03...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from an HTTP header injection vulnerability that stems from a Set-Cookie response header being incorrectly executed in a multipart HTTP response, which can be exploited by an...

infullcolor.brownpapertickets.com Cross Site Scripting vulnerability OBB-3854550

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

newsroom.salzburgerland.com Cross Site Scripting vulnerability OBB-3854406

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-21727

XSS vulnerability in DP Calendar component for Joomla...

CVE-2024-1523

CVE-2024-1523 — EC-WEB FS-EZViewer(Web) suffers from an injectable SQL vulnerability in its query functionality caused by a lack of proper input restrictions. This allows a remote attacker authenticated as a regular user to inject SQL commands to read, modify, and delete database records, and to ...

CVE-2024-25219

A cross-site scripting XSS vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Task Name parameter /TaskManager/Task.php...

dotnet: Denial of Service in SignalR server

A denial of service vulnerability is present in the .NET applications utilizing SignalR, which a malicious client can exploit. The issue arises from inadequate validation of user-supplied input in .NET. This flaw allows a remote attacker to trigger a denial of service DoS attack by providing...

CVE-2024-25208

CVE-2024-25208 affects Barangay Population Monitoring System v1.0. A cross-site scripting (XSS) vulnerability exists in the Add Resident function at /barangay-population-monitoring-system/masterlist.php, allowing an attacker to inject a crafted payload via the Full Name parameter to execute arbit...

CVE-2024-25207

The CVE-2024-25207 entry concerns Barangay Population Monitoring System v1.0, which has a cross-site scripting (XSS) flaw in the Add Resident function (masterlist.php) allowing payloads in the Contact Number field to execute arbitrary scripts. Affected component: Add Resident feature in Barangay ...

CVE-2024-25224

CVE-2024-25224 affects Simple Admin Panel App v1.0, with a cross-site scripting (XSS) vulnerability in the Add Size function, exploitable via crafted payloads to the Size Number parameter. Root cause is improper handling of input in that parameter, enabling arbitrary web script/HTML execution. Th...