WebCTRL OEM 6.5 - (locale) Reflected Cross-Site Scripting Vulnerability

Exploit Title: WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting XSS Exploit Author: 3ndG4me Vendor Homepage: https://www.automatedlogic.com/en/products/webctrl-building-automation-system/ Version: 6.5 and Below CVE : CVE-2021-31682 --Summary-- The login portal for the Automated Logic...

WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS)

Exploit Title: WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting XSS Date: 4/07/2021 Exploit Author: 3ndG4me Vendor Homepage: https://www.automatedlogic.com/en/products/webctrl-building-automation-system/ Version: 6.5 and Below CVE : CVE-2021-31682 --Summary-- The login portal for the...

CVE-2021-31682

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to...

CVE-2021-31682

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to...

Cross site scripting

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to...

CVE-2021-31682

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to...

CVE-2021-31682

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to...

CVE-2021-31682

The CVE-2021-31682 entry covers a reflected XSS in Automated Logic WebCTRL/WebCTRL OEM (WebCTRL OEM

CVE-2021-31682: Improper Neutralization of Input During Web Page Generation

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to...

PT-2021-19474

Name of the Vulnerable Software and Affected Versions Automated Logic WebCTRL/WebCTRL OEM versions 6.5 and below Description The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains an issue that allows for reflected XSS attacks due to the operatorlocale GET parameter...

Automated Logic WebCTRL System Cross-site Scripting Vulnerabilities

Automated Logic WebCTRL System 6.5 is an application from Automated Logic, Inc. It provides integrated alarm management and predictive HVAC planning. A cross-site scripting vulnerability exists in Automated Logic WebCTRL/WebCTRL OEM web, which stems from a lack of proper validation of client-side...

WebCTRL-OperatorLocale-Parameter-Reflected-XSS

WebCTRL-OperatorLocale-Parameter-Reflected-XSS WebCTRL Ref...

CVE-2020-19762

Automated Logic Corporation ALC WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request...

CVE-2020-19762

Automated Logic Corporation ALC WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request...

Cross site request forgery (csrf)

Automated Logic Corporation ALC WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request...

CVE-2020-19762

CVE-2020-19762 affects Automated Logic Corporation (ALC) WebCTRL System 6.5 and earlier. The vulnerability arises from an XSS flaw that allows remote attackers to execute arbitrary JavaScript code via the first parameter of a GET request. The description explicitly states the impact is remote cod...

CVE-2020-19762

Automated Logic Corporation ALC WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request...

Automated Logic WebCTRL System Cross-Site Scripting Vulnerability

Automated Logic WebCTRL System 6.5 is an application from Automated Logic, Inc. It provides integrated alarm management and predictive HVAC planning. A security vulnerability exists in Automated Logic Corporation ALC WebCTRL System 6.5 and prior, which can be exploited by remote attackers to...

CVE-2020-19762: Improper Neutralization of Input During Web Page Generation

Automated Logic Corporation ALC WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request...

PT-2021-10405

Name of the Vulnerable Software and Affected Versions: Automated Logic Corporation ALC WebCTRL System versions 6.5 and prior Description: The issue allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request. Recommendations: For versions 6.5...