Social Slider Widget < 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS)

The plugin allowed Authenticated Reflected XSS in the plugin settings page as the ‘tokenerror’ parameter can be controlled by users and it is directly echoed without being sanitized /wp-admin/admin.php?page=settings-wisw&tokenerror=alert/XSS/;...

The vulnerability of the ForeignKeyRawIdWidget implementation in the Django library allows attackers to perform cross-site scripting attacks.

The vulnerability of the ForeignKeyRawIdWidget implementation in the Django library is related to the lack of protective measures for the website structure. Exploiting this vulnerability could allow an attacker to perform cross-site scripting attacks remotely...

Sql injection

A second-order SQL injection issue in Widgets/TopDevicesController.php aka the Top Devices dashboard widget of LibreNMS before 21.1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the sortorder parameter against the /ajax/form/widget-settings endpoint...

LibreNMS SQL注入漏洞

Librenms is an open source network monitoring system based on PHP and MySQL from the Librenms community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A SQL injection vulnerability exists in LibreNMS versions prior to 21.1.0, which...

MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting

Exploit Title: MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting Date: 11/28/2018 Author: 0xB9 Software Link: https://github.com/zainali99/trends-widget Version: 1.2 Tested on: Windows 10 1. Description: This plugin shows the most trending threads. Trending thread titles aren't sanitized to...

MyBB Trending Widget 1.2 Cross Site Scripting

Exploit Title: MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting Date: 11/28/2018 Author: 0xB9 Software Link: https://github.com/zainali99/trends-widget Version: 1.2 Tested on: Windows 10 1. Description: This plugin shows the most trending threads. Trending thread titles aren't sanitized to...

OpenMage Magento Lts Code Execution Vulnerability

OpenMage Magento Lts Magento is an e-commerce system organized by OpenMage. A security vulnerability in OpenMage Magento Lts before versions 19.4.10 and 20.0.5 can be exploited by an attacker to remotely execute code, which can be injected into the server by an administrator with the privilege to...

Cisco Firepower Management Center XML Entity Expansion (cisco-sa-fmc-xee-DFzARDcs)

The version of Cisco Firepower Management Center FMC installed on the remote host is prior to 6.6.1. It is, therefore, affected by a vulnerability in the dashboard widget that allows an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The...

CVE-2020-26285

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an...

Remote code execution

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an...

CVE-2020-26285 Widget instances allows a hacker to inject an executable file on the server on OpenMage

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an...

CVE-2021-1267

A vulnerability in the dashboard widget of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit th...

Design/Logic Flaw

A vulnerability in the dashboard widget of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit th...

CVE-2021-1267 Cisco Firepower Management Center XML Entity Expansion Vulnerability

A vulnerability in the dashboard widget of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit th...

CVE-2021-1267

A vulnerability in the dashboard widget of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper restrictions on XML entities. An attacker could exploit th...

Cisco Firepower Management Center 安全漏洞

Cisco Firepower Management Center is the nerve center for managing Cisco network security solutions, improving the effectiveness of Cisco network security solutions by providing centralized, integrated, and simplified management. An XML entity extension vulnerability exists in the dashboard widge...

VulnCheck KEV: CVE-2020-17496

The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. This CVE ID resolves an incomplete patch for CVE-2019-16759...

Zabbix 5.0.0 Cross Site Scripting

Exploit Title: Zabbix 5.0.0 - Stored XSS via URL Widget Iframe Date: 8/11/2020 Exploit Author: Shwetabh Vishnoi Vendor Homepage: https://www.zabbix.com/ Software Link: https://www.zabbix.com/download Affected Version: Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before...

Zabbix 5.0.0 - Stored XSS via URL Widget Iframe

Exploit Title: Zabbix 5.0.0 - Stored XSS via URL Widget Iframe Date: 8/11/2020 Exploit Author: Shwetabh Vishnoi Vendor Homepage: https://www.zabbix.com/ Software Link: https://www.zabbix.com/download Affected Version: Zabbix before 3.0.32rc1, 4.x before 4.0.22rc1, 4.1.x through 4.4.x before...

CVE-2020-29441

An issue was discovered in the Upload Widget in OutSystems Platform 10 before 10.0.1019.0. An unauthenticated attacker can upload arbitrary files. In some cases, this attack may consume the available database space Denial of Service, corrupt legitimate data if files are being processed...