1358 matches found
CVE-2021-24657: Improper Neutralization of Input During Web Page Generation
The Limit Login Attempts WordPress plugin before 4.0.50 does not escape the IP addresses which can be controlled by attacker via headers such as X-Forwarded-For of attempted logins before outputting them in the reports table, leading to an Unauthenticated Stored Cross-Site Scripting issue...
Zoho ManageEngine ADSelfService Plus Access Control Error Vulnerability
ZOHO zoho manageengine adselfservice plus is a web-based end-user password management software from ZOHO. zoho ManageEngine ADSelfService Plus 6103 and earlier versions are vulnerable to an access control error that could be exploited by an attacker via the X The vulnerability can be exploited to...
Cross-site scripting in imgURL
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...
GHSA-F2RP-J8HV-G5GX Cross-site scripting in imgURL
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...
zoho manageengine adselfservice plus 数据伪造问题漏洞
ZOHO zoho manageengine adselfservice plus is a web-based end-user password management software from ZOHO. zoho ManageEngine ADSelfService Plus 6103 and earlier versions are vulnerable to an access control error that could be exploited by an attacker via the X The vulnerability can be exploited to...
CVE-2021-38713
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...
CVE-2021-38713
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...
CVE-2021-38713
The CVE-2021-38713 entry concerns imgURL 2.31, where a cross-site scripting (XSS) vulnerability can be triggered via the X-Forwarded-For HTTP header. Public references and multiple security trackers (Red Hat, GHSA, OSV, NVD, CNVD, etc.) consistently describe imgURL 2.31 as vulnerable to XSS throu...
CVE-2021-38713: Improper Neutralization of Input During Web Page Generation
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header...
Authorization Bypass
nilsteampassnet/teampass is vulnerable to authorization bypass. Sending an X-Forwarded-For client HTTP header to the getIp function allows any users with a valid API token to bypass IP address whitelist restrictions...
GHSA-FV48-HJHP-94C7 Incorrect Authorization in TeamPass
The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function...
CVE-2021-36755: Improper Neutralization of Input During Web Page Generation
Nightscout Web Monitor aka cgm-remote-monitor 14.2.2 allows XSS via a crafted X-Forwarded-For header...
CVE-2020-29146
A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...
CVE-2020-29146
A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...
Cross site scripting
A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...
CVE-2020-29146
A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...
CVE-2020-29146: Improper Neutralization of Input During Web Page Generation
A cross site scripting XSS vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header...
CVE-2020-18979
Cross Siste Scripting XSS vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter...