Puncsky Touchbase.ai Cross-Site Scripting Vulnerability

Puncsky Touchbase.ai is a web platform for interpersonal relationships by Puncsky Individual Developers. A cross-site scripting vulnerability exists in versions prior to touchbase.ai 2.0, which can be exploited by an attacker to inject an HTML payload, resulting in damage, user redirection to a...

SugarCRM 6.5.18 Cross Site Scripting

Document Title: =============== SugarCRM v6.5.18 - Contacts Persistent Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2249 Release Date: ============= 2020-11-16 Vulnerability Laboratory ID VL-ID:...

IBM Content Navigator Cross-Site Scripting Vulnerability (CNVD-2020-62468)

IBM Content Navigator is a Web client that provides users with a console that enables them to access, manage, and use corporate content anytime, anywhere, from any location in the organization on virtually any mobile device. A stored cross-site scripting vulnerability exists in IBM Content...

IBM Maximo Spatial Asset Management Web Local Storage Vulnerability

IBM Maximo Spatial Asset Management is used to visually manage the spatial relationships between assets and other mapped elements. A web page local storage vulnerability exists in IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0. An attacker could exploit the vulnerabili...

USN-4620-1 phpldapadmin vulnerability

It was discovered that phpLDAPadmin didn't properly sanitize before being echoed to the user. A remote attacker could inject arbitrary HTML/Javascript code in a user's context and cause a crash, resulting in denial of service or potential execution of arbitrary code...

rutor.download Cross Site Scripting vulnerability OBB-1475598

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Command Execution Vulnerability in 162100 Website Navigation 3

162100 url navigation 3 is a website source code of url navigation category developed by php+MySQL. 162100 url navigation 3 has a command execution vulnerability. An attacker can exploit the vulnerability to write to a php file, resulting in command execution...

Microsoft SharePoint Server Cross-Site Scripting Vulnerability (CNVD-2020-61067)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

SQL Injection Vulnerability in Five Fingers CMS

Five Fingers CMS is an open source content management system. Five Fingers CMS suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

CVE-2020-26649

AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php...

CVE-2020-6367

There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that t...

Cross-site Scripting (XSS)

Overview lightning-server is a lightning dataviz notebooks server. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible to inject malicious JavaScript code as part of a session controller. PoC POST...

Command Execution Vulnerability in Ocean CMS

Ocean CMS seacms, Ocean Video Management System is a video-on-demand system designed for webmasters with different needs. A command execution vulnerability exists in the background of Ocean CMS. Attackers can use this vulnerability to write malicious code to execute system commands and obtain...

SQL Injection Vulnerability in ZZCMS2020 Backend (CNVD-2020-59407)

ZZCMS is a content management system. A SQL injection vulnerability exists in the backend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...

jcontainer.net Cross Site Scripting vulnerability OBB-1403124

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

File Deletion Vulnerability in ShuipFCMS Content Management System

ShuipFCMS a content management system based on ThinkPHP framework as the core, using an independent grouping approach to development. ShuipFCMS content management system file deletion vulnerability, an attacker can be exploited to delete the install.lock file can lead to the reinstallation of the...

The vulnerability of the Microsoft Dynamics 365 resource planning software lies in the lack of protective measures for the website structure, allowing attackers to execute cross-site scripting attacks.

The vulnerability of the Microsoft Dynamics 365 resource planning software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using specially crafted requests...

CVE-2020-22453

Untis WebUntis before 2020.9.6 allows XSS in multiple functions that store information...

IBM Data Risk Manager Cross-Site Request Forgery Vulnerability

IBM Data Risk Manager is a data risk manager that helps discover, analyze and visualize business risks associated with data. A cross-site request forgery vulnerability exists in IBM Data Risk Manager 2.0.6. An attacker could exploit this vulnerability to perform malicious and unauthorized actions...

Reflected File Download (RFD) Attack

spring-web is vulnerable to Reflected File Download RFD attack. An incomplete fix of CVE-2015-5211 allows an attacker to bypass the protection against RFD attack via the jsessionid path parameter...