CVE-2022-43079

A cross-site scripting XSS vulnerability in /admin/add-fee.php of Train Scheduler App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter...

Train Scheduler App 跨站脚本漏洞

Train Scheduler App is a train scheduling application by Carlo Montero Personal Developer. A security vulnerability exists in Train Scheduler App v1.0, which stems from a cross-site scripting XSS vulnerability contained in /admin/add-fee. An attacker can exploit this vulnerability to execute...

PT-2022-20923

Name of the Vulnerable Software and Affected Versions Apache Spark versions 3.2.1 and earlier, 3.3.0 Description A stored cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the...

CVE-2022-39027

U-Office Force Forum function has insufficient filtering for special characters. A remote attacker with general user privilege can inject JavaScript and perform XSS Stored Cross-Site Scripting attack...

CVE-2022-37915

A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands o...

SEMCMS SQL注入漏洞

SEMCMS is a multilingual content management system CMS for foreign trade websites. A SQL injection vulnerability exists in SEMCMS SHOP version 1.1, which stems from a SQL injection issue in AntPlist.php...

School Activity Updates with SMS Notification SQL注入漏洞

School Activity Updates with SMS Notification is an online activity update with SMS notification from janobe Personal Developer. It is used to ensure that every student receives an SMS notification every time there is an event at school. A security vulnerability exists in School Activity Updates...

UBUNTU-CVE-2022-42927

A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via performance.getEntries. This vulnerability affects Firefox 106, Firefox ESR 102.4, and Thunderbird 102.4...

The vulnerability of the J-Web interface in Juniper Networks Junos OS allows attackers to execute cross-site scripting attacks.

The vulnerability of the J-Web interface in Juniper Networks Junos OS operating systems is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Oracle PeopleSoft Enterprise Common Components 安全漏洞

Oracle PeopleSoft Enterprise Common Components are a set of public components from Oracle Corporation USA. A security vulnerability exists in Oracle PeopleSoft Enterprise Common Components. A low-privileged attacker with network access via HTTP could compromise the PeopleSoft Enterprise Common...

Webile 1.0.1 Directory Traversal

Document Title: =============== Webile v1.0.1 - Directory Traversal Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2320 Release Date: ============= 2022-10-10 Vulnerability Laboratory ID VL-ID: ==================================== 232...

Stripe Green Downloads 2.03 Cross Site Scripting

Document Title: =============== Stripe Green Downloads 2.03 - Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2287 Release Date: ============= 2022-10-17 Vulnerability Laboratory ID VL-ID: ===================================...

CVE-2022-41391

OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php...

Rdiffweb 访问控制错误漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. An access control error vulnerability exists in Rdiffweb 2.5.0a5, which stems from a source validation error...

SAP Enable Now 跨站脚本漏洞

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning and training in SAP and non-SAP systems. A cross-site scripting vulnerability exists in SAP Enable Now 10 version 1. The vulnerability stems from failure to...

CREALOGIX EBICS 跨站脚本漏洞

A cross-site scripting vulnerability exists in CREALOGIX EBICS version 7.0, which stems from the lack of effective filtering and escaping of user-supplied data in the /ebics-server/ebics.aspx file, which could be exploited to inject cross-site code and launch XSS attack...

Web-Based Student Clearance System SQL注入漏洞

Web-Based Student Clearance System is a web-based student clearance system from the personal developer Ndueso Okorie.A SQL injection vulnerability exists in Web-Based Student Clearance System, which stems from the lack of validation of external input SQL statements in the parameter txtusername in...

Simple Cold Storage Management System SQL注入漏洞

Simple Cold Storage Management System is a cold storage management system. Simple Cold Storage Management System /csms/admin/storages/managestorage.php?id= is vulnerable to SQL injection. A remote attacker can use this vulnerability to submit a special SQL request to manipulate the database, whic...

MediaWiki 跨站脚本漏洞

MediaWiki is a free and free-to-use web-based wiki engine from the U.S. Wikimedia MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. MediaWiki has a cross-site scripting vulnerability that can be exploited by attackers to inject...

Canon Medical Vitrea View 跨站脚本漏洞

Canon Medical Vitrea View is a DICOM network-enabled enterprise viewing solution from Canon, Japan. A cross-site scripting vulnerability exists in Canon Medical Vitrea View, which is used to visually display DICOM and multimedia images. An attacker could use this vulnerability to execute arbitrar...