15170 matches found
PT-2023-29624 · Mailmunch · Constant Contact Forms By Mailmunch
Name of the Vulnerable Software and Affected Versions: MailMunch Constant Contact Forms by MailMunch plugin versions = 2.0.10 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...
PT-2023-29478 · Sendpulse · Sendpulse Free Web Push Plugin
Name of the Vulnerable Software and Affected Versions: SendPulse Free Web Push plugin versions = 1.3.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...
Awesome Support < 6.1.5 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC Visit the following URL as an admin user, with any valid ticket ID. Press the acce...
play.webvideocore.net Cross Site Scripting vulnerability OBB-3746968
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Weintek cMT Buffer Error Vulnerability
Weintek cMT is a human machine interface application from Weintek. A security vulnerability exists in the Weintek cMT3000 HMI Web CGI, which stems from the fact that cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypa...
CVE-2023-32721
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-32721
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-32721
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
Cross site scripting
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-32721
CVE-2023-32721 is a stored XSS in the Zabbix web application (Maps element) triggered when a URL field contains leading spaces. The issue is documented across multiple feeds as a Zabbix frontend input handling vulnerability with practical impact on stored content and potentially user sessions. Pu...
CVE-2023-32721 Stored XSS in Maps element
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-32721
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
Zabbix Cross-Site Scripting Vulnerability
Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A security vulnerability exists in the Zabbix web application that stems from the presence of a stored cross-site scripting XSS...
CVE-2023-32721
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-45132
NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...
NAXSI Security Vulnerabilities
NAXSI is an open source maintained Web Application Firewall WAF for NGINX. A security vulnerability exists in NAXSI 1.3 and earlier versions that stems from allowing bypass of WAF IgnoreIP IgnoreCIDR when a malicious IP matches a rule...
Sql injection
Election Services Co. ESC Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused...
CVE-2023-4309
CVE-2023-4309 affects Election Services Co. (ESC) Internet Election Service. Multiple pages/parameters are vulnerable to SQL injection, allowing an unauthenticated, remote attacker to read or modify data for any elections sharing the same backend database. The public documentation consistently no...
CVE-2023-4309
Election Services Co. ESC Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an unauthenticated, remote attacker to read or modify data for any elections that share the same backend database. ESC deactivated older and unused...
