Purchase Order Management 跨站脚本漏洞

Sourcecodester Purchase Order Management System is a simple purchase order management system used to manage the purchase order records of a particular company. A security vulnerability exists in Purchase Order Management v1.0, which was discovered to contain a Reflected Cross Site Scripting XSS...

Sielco Analog FM Transmitter 2.12 Cross Site Request Forgery Vulnerability

!-- Sielco Analog FM Transmitter 2.12 Cross-Site Request Forgery Vendor: Sielco S.r.l Product web page: https://www.sielco.org Affected version: 2.12 EXC5000GX 2.12 EXC120GX 2.11 EXC300GX 2.10 EXC1600GX 2.10 EXC2000GX 2.08 EXC1600GX 2.08 EXC1000GX 2.07 EXC3000GX 2.06 EXC5000GX 1.7.7 EXC30GT 1.7.4...

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server’s server lies in the lack of security measures taken to protect the website structure. This allows attackers to carry out cross-site scripting attacks.

The vulnerability of Hitachi Vantara Pentaho Business Analytics Server servers exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to perform cross-site attacks remotely...

weblog.tc Cross Site Scripting vulnerability OBB-3258432

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Siemens SCALANCE W1750D Improper Neutralization of Input During Web Page Generation (CVE-2022-37892)

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a...

xxl-job 跨站脚本漏洞

XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xue Li XXL-JOB community. A security vulnerability exists in xxl-job, which originates from the successful execution of loads uploaded via HTML in /xxl-job-admin/user/add and /xxl-job-admin/user/update...

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business models RV016, RV042, RV042G, RV082, RV320, and RV325 allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform...

auto-svetla.cz Cross Site Scripting vulnerability OBB-3250310

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

UBUNTU-CVE-2023-28639

GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is...

GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

Dynamic Transaction Queuing System SQL注入漏洞

Dynamic Transaction Queuing System is a dynamic transaction queuing system using PHP/MySQL by Carlo Montero's personal developer. A security vulnerability exists in version v1.0 of the Dynamic Transaction Queuing System, which stems from an SQL injection issue in /admin/ajax.php?action=login...

The vulnerability in the web interface of the Aruba Networks ClearPass Policy Manager allows a attacker to execute XSS attacks.

The vulnerability in the web interface of the Aruba Networks ClearPass Policy Manager exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

b3log Wide 路径遍历漏洞

b3log Wide is a web-based integrated development environment IDE for the Go language. A security vulnerability exists in B3log Wide that stems from the program allowing an attacker to elevate privileges via symbolic links...

PT-2023-7387 · Unknown · Osprey Pump Controller

Name of the Vulnerable Software and Affected Versions: Osprey Pump Controller version 1.01 Description: The issue exists due to inadequate protection of the web page structure, allowing a remote attacker to execute arbitrary code. Specifically, inputs passed to a GET parameter are not properly...

XiaoBingBy TeaCMS 跨站脚本漏洞

XiaoBingBy TeaCMS is a blog system by xiaobingby personal developer. A security vulnerability exists in XiaoBingBy TeaCMS version 2.0.2 and earlier versions. The vulnerability can be exploited by attackers to conduct cross-site scripting attacks...

TOTOLINK A7100RU 命令注入漏洞

The TOTOLINK A7100RU is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A7100RU suffers from a command injection vulnerability that stems from the enabled parameter of cgi-bin/cstecgi.cgi failing to properly filter constructed command special characters, commands, etc., whi...

Student Study Center Desk Management System 跨站脚本漏洞

Student Study Center Desk Management System is a student study center desk management system. A cross-site scripting vulnerability exists in SourceCodester Student Study Center Desk Management System version 1.0, which stems from a problem in the file /admin/assign/assign.php, where manipulation ...

Simple and Beautiful Shopping Cart System 代码问题漏洞

Simple and Beautiful Shopping Cart System is an e-commerce platform. A code issue exists in version 1.0 of the Simple and Beautiful Shopping Cart System, which stems from a security issue with an unknown function in the file uploadera.php that results in unrestricted uploads...

PT-2023-17022 · Sourcecodester · Sourcecodester Young Entrepreneur E-Negosyo System

Name of the Vulnerable Software and Affected Versions: SourceCodester Young Entrepreneur E-Negosyo System version 1.0 Description: A problematic vulnerability has been found in the GET Parameter Handler component of the file /bsenordering/index.php. The manipulation of the category argument with...

PT-2023-21571 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to 3.1.0.beta3 Description: Discourse is an open-source discussion platform. Prior to version 3.1.0.beta3 of the beta and tests-passed branches, some user-provided URLs were being passed to FastImage without SSRF...