336 matches found
CVE-2021-35059
OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter...
CVE-2017-6511
andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php...
CVE-2005-2318
Cross-site scripting XSS vulnerability in showerr.asp in DVBBS 7.1 SP2 allows remote attackers to inject arbitrary web script or HTML via the action parameter...
Inetum IODAS 代码注入漏洞
Inetum IODAS is an enterprise-grade data archiving and storage management platform from Inetum France that supports hybrid cloud data lifecycle management. A code injection vulnerability exists in Inetum IODAS versions 7.2-LTS.4.1-JDK7 and 7.2-RC3.2-JDK7, which stems from cross-site scripting due...
phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting (XSS)
Exploit Title: phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting XSS Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/thorsten/phpMyFAQ Software Link: https://github.com/thorsten/phpMyFAQ Version: 3.1.7 Tested on: Ubuntu Windows CVE : CVE-2022-4407 PoC: Get:...
📄 phpMyFAQ 3.1.7 Cross Site Scripting
phpMyFAQ version 3.1.7 suffers from a cross site scripting vulnerability. Exploit Title: phpMyFAQ 3.1.7 - Reflected Cross-Site Scripting XSS Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/thorsten/phpMyFAQ Software Link: https://github.com/thorsten/phpMyFAQ Versio...
CVE-2024-9197
A post-authentication buffer overflow vulnerability in the parameter "action" of the CGI program in Zyxel VMG3625-T50B firmware versions through V5.50ABPM.9.2C0 could allow an authenticated attacker with administrator privileges to cause a temporary denial of service DoS condition against the web...
PT-2024-39481 · Zyxel · Zyxel Vmg3625-T50B
Name of the Vulnerable Software and Affected Versions: Zyxel VMG3625-T50B firmware versions through V5.50ABPM.9.2C0 Description: A post-authentication buffer overflow vulnerability in the action parameter of the CGI program could allow an authenticated attacker with administrator privileges to...
CVE-2024-9653
The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress plugin xili-tidy-tags 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2024-45888
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to setapmapconfig.'...
PT-2024-31838 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue is a post-authentication command injection vulnerability. It occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to commandTable. This vulnerability happe...
CVE-2024-9383
The Parcel Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 1.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...
PT-2024-39608 · WordPress · Parcel Pro
Name of the Vulnerable Software and Affected Versions: Parcel Pro plugin for WordPress versions up to, and including, 1.8.4 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inje...
CVE-2024-8413
Cross Site Scripting XSS vulnerability through the action parameter in index.php. Affected product codebase https://github.com/Bioshox/Raspcontrol and forks such as https://github.com/harmon25/raspcontrol . An attacker could exploit this vulnerability by sending a specially crafted JavaScript...
PT-2024-38995 · Bioshox · Raspcontrol
Name of the Vulnerable Software and Affected Versions: Raspcontrol version 1.0 Description: A Cross Site Scripting XSS issue exists through the action parameter in index.php. This allows an attacker to send a specially crafted JavaScript payload to an authenticated user, potentially hijacking the...
Raspcontrol 跨站脚本漏洞
Raspcontrol is a web control center written in PHP for the Raspberry Pi by Doug W., a personal developer. A cross-site scripting vulnerability exists in Raspcontrol version 1.0, which stems from a cross-site scripting XSS vulnerability via the parameter action in index.php...
PT-2024-38162 · Sourcecodester · Sourcecodester Complaint Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Complaints Report Management System version 1.0 Description: A problematic issue has been found in the system, affecting the processing of the file "/admin/ajax.php?action=save settings". The manipulation of the name argument...
