Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "billname" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill...

GHSA-888J-PJQH-FX58 Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php

Summary A Stored Cross-Site Scripting XSS vulnerability in the "Manage User Access" page allows authenticated users to inject arbitrary JavaScript through the "billname" parameter when creating a new bill. This vulnerability can lead to the execution of malicious code when visiting the "Bill...

CVE-2024-49754

LibreNMS (PHP/MySQL/SNMP-based network monitoring) has a Stored XSS vulnerability in the API-Access page. The issue, triggered by the token parameter when creating a new API token, allows an authenticated user to inject JavaScript that runs in other users’ sessions. Impact includes potential acco...

Improper Access Control in janeczku/calibre-web

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...

CVE-2021-3987

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...

CVE-2021-3987 Improper Access Control in janeczku/calibre-web

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...

CVE-2021-3987

CVE-2021-3987 (janeczku/calibre-web) is an improper access control flaw where the public shelf creation path (shelf.py: create_shelf) does not verify user permissions, allowing low-privilege users to create public shelves and perform unauthorized actions. Public disclosures in multiple feeds corr...

CVE-2021-3987

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...

CVE-2024-10311

The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edbaadminhandle' function. This makes it possible for authenticated attackers, with subscriber-level permissions...

PT-2024-16747 · WordPress · Wp Log Viewer

Name of the Vulnerable Software and Affected Versions: WP Log Viewer plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to unauthorized use of functionality due to a missing capability check on several AJAX actions. This allows authenticated attackers with...

CVE-2024-10311: Authentication Bypass Using an Alternate Path or Channel

The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edbaadminhandle' function. This makes it possible for authenticated attackers, with subscriber-level permissions...

PT-2024-16178 · WordPress · External Database Based Actions

Name of the Vulnerable Software and Affected Versions: External Database Based Actions plugin for WordPress version 0.1 and earlier Description: The issue is due to a missing capability check in the edba admin handle function, allowing authenticated attackers with subscriber-level permissions and...

CVE-2021-3987: Improper Access Control

An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions to create public shelves. The vulnerability is due to the createshelf method in shelf.py not verifying if the user has the necessary permissions to create a...

PT-2024-34546 · Jepaas · Jepaas

Name of the Vulnerable Software and Affected Versions: JEPaaS version 7.2.8 Description: The issue is related to SQL injection vulnerability in multiple parameters via the "/je/login/btnLog/insertBtnLog" API endpoint. This could allow a remote user to submit a specially crafted query, enabling an...

PT-2024-11004

Name of the Vulnerable Software and Affected Versions janeczku/calibre-web affected versions not specified Description An improper access control issue exists, allowing users without public shelf permissions to create public shelves. This is due to the create shelf method in shelf.py not verifyin...

CVE-2024-51496: Improper Neutralization of Input During Web Page Generation

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Reflected Cross-Site Scripting XSS vulnerability in the "metric" parameter of the "/wireless" and "/health" endpoints allows attackers to inject arbitrary JavaScript. This vulnerability results in the execution of...

WordPress plugin: Security vulnerabilities in External Database-Based actions

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A security vulnerability exists in WordPress plugin...

CVE-2022-2232

A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions...

CVE-2022-2232 Keycloak: ldap injection on username input

A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions...

CVE-2024-5920

A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS software enables an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator who can perform restricted actions ...