Apple Zeed ALL YOUR STYLE CMS 2.0 SQL Injection

======================================================================================== | Title : Apple Zeed ALL YOUR STYLE CMS 2.0 SQL injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 109.064-bit | | Vendor :...

scaccidentlawyer.com Cross Site Scripting vulnerability OBB-3368396

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

culture41.fr Cross Site Scripting vulnerability OBB-3367198

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

woldhuisfarms.com Cross Site Scripting vulnerability OBB-3366192

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

tristandc.com Cross Site Scripting vulnerability OBB-3366143

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

What is a web shell?

Editors note: The Need to Know is a new series from Talos, which focuses on cybersecurity terms, threats, tools and tactics that are discussed in our broader threat research. Think of this as a living encyclopedia of security terms and trends. Cisco Talos Incident Response recently released our...

uniquemagazines.co.uk Cross Site Scripting vulnerability OBB-3363677

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

wl4www229.webland.ch Cross Site Scripting vulnerability OBB-3363421

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

golang: html/template: improper handling of empty HTML attributes

A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...

CVE-2023-33751

CVE-2023-33751 affects mipjz v5.0.5. The vulnerability is a stored XSS in the name parameter at /app/tag/controller/ApiAdminTagCategory.php, allowing arbitrary web scripts/HTML execution. Exploit details are not provided in the connected documents; exploitation status is listed as null. No remedi...

CVE-2023-33750

CVE-2023-33750 is a stored XSS vulnerability affecting mipjz v5.0.5. The flaw allows an attacker to inject arbitrary web scripts/HTML via the Description parameter in /index.php?s=/article/ApiAdminArticle/itemAdd, enabling client-side exploitation when a user views the infected page. The CVSS/met...

toui allows user-specific variables to be shared between users

Impact Websites that use Website.uservars property in versions. Patches It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1 Workarounds Do not use Website.uservars in websites when using versions v2.0.1 to v2.4.0. Also, do not use Website.signinuser in version v2.4.0 only. Explanation...

CVE-2023-33797

Summary: CVE-2023-33797 is a stored XSS vulnerability in NetBox v3.5.1 affecting the Create Sites endpoint (/dcim/sites/) where a crafted payload injected into the Name field can execute arbitrary scripts/HTML. Technical details in sources indicate NetBox 3.5.1 is affected; no explicit exploit co...

SitemagicCMS 4.4.3 Shell Upload

Exploit Title: SitemagicCMS 4.4.3 Remote Code Execution RCE Application: SitemagicCMS Version: 4.4.3 Bugs: RCE Technology: PHP Vendor URL: https://sitemagic.org/Download.html Software Link: https://github.com/Jemt/SitemagicCMS Date of found: 14-05-2023 Author: Mirabbas Ağalarov Tested on: Linux 2...

CVE-2023-33787

The CVE-2023-33787 entry concerns a stored cross-site scripting (XSS) vulnerability in NetBox v3.5.1, specifically in the Create Tenant Groups API at /tenancy/tenant-groups/ where a crafted payload in the Name field can execute arbitrary web scripts/HTML. Affected component: the Create Tenant Gro...

CVE-2023-33792

NetBox CVE-2023-33792 is a stored XSS in the Create Site Groups API (/dcim/site-groups/) affecting NetBox v3.5.1. The payload is injected into the Name field, allowing execution of arbitrary web scripts or HTML. CVSS v3.1 base score 5.4 (MEDIUM) with network attack vector, user interaction requir...

CVE-2023-33800

A stored cross-site scripting XSS vulnerability in the Create Regions /dcim/regions/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

CVE-2023-33797

A stored cross-site scripting XSS vulnerability in the Create Sites /dcim/sites/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

CVE-2023-33793

A stored cross-site scripting XSS vulnerability in the Create Power Panels /dcim/power-panels/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...