CVE-2021-31537

The CVE-2021-31537 issue affects SIS Informatik REWE GO prior to version 7.7 SP17, with a reflected XSS in rewe/prod/web/index.php (parameters: config, version, win, db, pwd, user) and rewe/prod/web/rewe_go_check.php (version and other parameters). Nuclei templates confirm the vulnerable paths an...

Microsoft Dynamics Finance & Operations 跨站脚本漏洞

Microsoft Dynamics Finance & Operations is an application from Microsoft Corporation USA. A Finance & Operations program. A cross-site scripting vulnerability exists in Microsoft Dynamics Finance & Operations. The following products and versions are affected:Dynamics 365 for Finance and...

CVE-2021-28149

CVE-2021-28149 (Hongdian H8922 3.0.5) is a local file inclusion vulnerability in the device’s /log_download.cgi log export handler. The issue arises because user input is not validated, allowing a remote attacker with minimal privileges to download arbitrary files from the device by substituting ...

CVE-2021-1516

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance SMA, Cisco Email Security Appliance ESA, and Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to access sensitive information on an affecte...

CVE-2021-1490

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to improper...

CVE-2021-1490

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to improper...

Cross site scripting

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to improper...

CVE-2021-1516

CVE-2021-1516 affects Cisco AsyncOS Software on the Cisco Content Security Management Appliance (SMA), Email Security Appliance (ESA), and Web Security Appliance (WSA). Root cause: confidential information is included in HTTP requests exchanged between the user and the device, allowing an authent...

CVE-2021-1490 Cisco Web Security Appliance Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to improper...

CVE-2021-1490

CVE-2021-1490 : Cisco Web Security Appliance (WSA) uses Cisco AsyncOS with a web-based management interface vulnerable to cross-site scripting (XSS) due to improper validation of user-supplied input. An unauthenticated, remote attacker can lure a user to upload a crafted file containing a malicio...

Anti-Spam WordPress Plugin Could Expose Website User Data

An SQL-injection vulnerability discovered in a WordPress plugin called “Spam protection, AntiSpam, FireWall by CleanTalk” could expose user emails, passwords, credit-card data and other sensitive information to an unauthenticated attacker. Spam protection, AntiSpam, FireWall by CleanTalk is...

CVE-2021-1490

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to improper...

Cisco Web Security Appliance Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface of an affected device. This vulnerability is due to improper...

Cisco Web Security Appliance 跨站脚本漏洞

Cisco Secure Web Appliance is an application from Cisco USA Inc. It is used to protect Web sites. A cross-site scripting vulnerability exists in the Cisco Web Security Appliance that originates from incorrect validation of user-supplied input in the web-based management interface. An attacker cou...

Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting

Exploit Title: Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting Date: 2021-05-04 Exploit Author: strider Software Link: https://github.com/savsofts/savsoftquizv5 Vendor: https://savsoftquiz.com Version: 5.0 Tested on: Ubuntu 20.04 LTS / Kali Linux...

Cross-site Scripting (XSS) - Reflected in blockonomics/woocommerce-plugin

✍️ Description Reflected javascript injection vulnerabilities exist when web applications take parameters from the URL and display them on a page. Reflection vulnerabilities occur when a website outputs a variable from the webpage URL directly to the page, such as in a PHP application that accepts...

CVE-2021-21542

Dell EMC iDRAC9 (

Rapid7's 2021 ICER Takeaways: Web Security Among the Fortune 500

This blog post covers key takeaways from our 2021 Industry Cyber-Exposure Report ICER: Fortune 500. The vast majority of the interactions an average person has with technology is through some form of a web application, but what constitutes a “web app” can be considered quite nebulous, and the...

CVE-2021-28280

PHPFusion 9.03.110 is affected by a CSRF and XSS vulnerability in search.php that allows remote attackers to inject arbitrary web script or HTML. This has been reported across multiple sources (NVD, Red Hat, CNVD, OSV, CNVD, OpenVAS and others) with consistent description. The CVE is not accompan...

vulhub

This repository is an open-source collection of pre-built vulnerable docker environments, referred to as 'Vulhub'. It is an offensive tool for web application security testing and vulnerability research. The primary vulnerability class targeted by this collection is web application vulnerabilitie...