CVE-2022-44946

CVE-2022-44946 – Rukovoditel v3.2.1 suffers a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. An attacker can inject arbitrary HTML/JS via the Title field, potentially affecting administrators and project data when the...

Sanitization Management System SQL注入漏洞

Sanitization Management System is a sanitization management system by Carlo Montero Personal Developer. A security vulnerability exists in Sanitization Management System v1.0, which originates from an SQL injection via /php-sms/admin/?page=services/manageservice&id=...

CVE-2022-3897

The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2022-45225

Book Store Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in /bsmsci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the booktitle parameter...

CVE-2022-41958

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...

CVE-2022-41958 Deserialization Vulnerability by yaml config input in super-xray

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...

CVE-2022-41958 Deserialization Vulnerability by yaml config input in super-xray

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...

CVE-2022-41958

CVE-2022-41958 affects the web vulnerability scanning tool super-xray . Versions prior to 0.7 stored configuration (YAML) that could be attacked by an attacker with local access to the file, enabling a compromise of the program. The issue is addressed in commit 4d0d5966 and will be included in fu...

WBCE CMS 跨站脚本漏洞

WBCE CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in WBCE CMS 1.5.4 and previous versions, which stems from the lack of effective filtering and escaping of user-supplied data in the Footer field of the Search Settings...

MTN Group: Reflected - XSS

The Reflected XSS vulnerability was discovered on the website www.mtn.bj. The vulnerability was triggered by entering a malicious payload in the Messages section, which resulted in the execution of the payload on the client-side...

GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

PT-2022-7410 · Unknown +1 · Glpi Reports Plugin +1

Name of the Vulnerable Software and Affected Versions: GLPI reports plugin affected versions not specified Description: The issue is related to the incorrect neutralization of input data during web page generation, allowing a remote attacker to conduct Cross-Site-Scripting XSS attacks via a...

Six Apart Movable Type 跨站脚本漏洞

Six Apart Movable Type is an application from Six Apart USA. It provides features such as multiple users, comments, references TrackBack, and themes. A security vulnerability exists in Six Apart Movable Type, which can be exploited by an attacker to execute arbitrary scripts on a web browser, and...

HMS-PHP 安全漏洞

HMS-PHP is a CSE309 IUB final web application project by the individual developer Pingkon Augustine Rozario. A security vulnerability exists in Pingkon HMS-PHP, which stems from an unknown function in the file /admin/admin.php being affected, where manipulation of the parameter uname/pass can lea...

Online Diagnostic Lab Management System SQL注入漏洞

Online Diagnostic Lab Management System is an online diagnostic lab management system. A security vulnerability exists in Online Diagnostic Lab Management System v1.0, which stems from the id parameter of its /odlms/classes/Users.php?f=delete component that allows an attacker to implement SQL...

CVE-2022-42745

CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE...

CVE-2022-38373

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting XSS attack via sending requests with specially crafted lure resource ID...

CVE-2022-43328

Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /editorder.php...

PYSEC-2022-42976

A stored cross-site scripting XSS vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI...

CVE-2022-43082

A cross-site scripting XSS vulnerability in /fastfood/purchase.php of Fast Food Ordering System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the customer parameter...