Cross site scripting

An XSS issue was discovered in a web endpoint in Zimbra Collaboration ZCS before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36...

CVE-2023-48940

DaiCuo v2.5.15 contains a stored XSS in /admin.php. The vulnerability allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. CVSS~3.1 base score 5.4 (NETWORK, LOW attack complexity, user interaction required). Evidence is limited to the CVE description and associated r...

lopezfernandezabogados.com Improper Access Control vulnerability OBB-3804007

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bikuri.net Cross Site Scripting vulnerability OBB-3803493

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

quarkus: HTTP security policy bypass

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized...

PHPJabbers Appointment Scheduler 3.0 HTML Injection

Exploit Title: PHPJabbers Appointment Scheduler v3.0 - Multiple HTML Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/appointment-scheduler/ Version: v3.0 Tested on: Window...

PHPJabbers Availability Booking Calendar 5.0 HTML Injection

Exploit Title: PHPJabbers Availability Booking Calendar v5.0 - HTML Injection Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/availability-booking-calendar/sectionDemo Version: v5.0...

PHPJabbers Time Slots Booking Calendar 4.0 HTML Injection

Exploit Title: PHPJabbers Time Slots Booking Calendar v4.0 - HTML Injection Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/time-slots-booking-calendar/ Version: v4.0 Tested on:...

PHPJabbers Car Rental 3.0 HTML Injection

Exploit Title: PHPJabbers Car Rental v3.0 - HTML Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/car-rental-script/ Version: v3.0 Tested on: Windows 10, Windows 11, Linux...

e-ter.com Improper Access Control vulnerability OBB-3799037

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-48746

CVE-2023-48746 affects the WordPress plugin Community by PeepSo (PeepSo Core) up to version 6.2.6.0, with a Reflected Cross-Site Scripting (XSS) vulnerability in Web Page Generation input handling. The root cause is improper input neutralization during page generation, enabling unauthenticated at...

CVE-2023-48749

CVE-2023-48749: Salient Core for WordPress is affected by an Stored XSS due to improper input neutralization in web page generation. The vulnerability applies to Salient Core versions

CVE-2023-39921

CVE-2023-39921 describes a Stored XSS in the Molongui Author Box, Guest Author and Co-Authors for Your Posts plugin for WordPress (up to 4.6.19). The issue stems from improper input sanitization during web page generation, enabling injection of scripts by authenticated administrators. Affected co...

auteursdumaine.net Cross Site Scripting vulnerability OBB-3798725

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-47850

CVE-2023-47850 affects the WordPress plugin Community by PeepSo – PeepSo Core up to version 6.2.2.0, with stored stored Cross-Site Scripting (XSS) arising from improper input neutralization during web page generation. Public details confirm the vulnerability and affected versions; PatchStack note...

CVE-2023-48329

CVE-2023-48329 affects the WordPress plugin Fast Custom Social Share by CodeBard (versions ≤ 1.1.1). The issue is a Cross-Site Scripting (Stored XSS) caused by improper neutralization during web page generation. Exploitation requires administrator privileges, and the vulnerability status is curre...

fokus-leben.de Cross Site Scripting vulnerability OBB-3798690

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross site scripting

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Document Properties field at /login.php m=admin&c=Index&a=changeTableVal&ajax=1&lang=cn...

Discover Why Proactive Web Security Outsmarts Traditional Antivirus Solutions

In a rapidly evolving digital landscape, it's crucial to reevaluate how we secure web environments. Traditional antivirus-approach solutions have their merits, but they're reactive. A new report delves into the reasons for embracing proactive web security solutions, ensuring you stay ahead of...

CVE-2023-48881

CVE-2023-48881 – EyouCMS v1.6.4-UTF8-SP1 stored XSS is documented across multiple sources. The vulnerability affects the login workflow at /login.php?m=admin&c=Field&a=arctype_add&_ajax=1&lang=cn, where a crafted payload injected into the Field Title field can execute arbitrary web scripts/HTML. ...