PT-2022-18783 · Shopxo · Shopxo

Name of the Vulnerable Software and Affected Versions: ShopXO versions 2.2.5 and below Description: The issue is related to a system re-install vulnerability. It is exploited via the Add function in the app/install/controller/Index.php file. Recommendations: For versions 2.2.5 and below, consider...

CVE-2022-28522

ZCMS v20170206 was discovered to contain a stored cross-site scripting XSS vulnerability via index.php?m=home&c=message&a=add...

MasterChef.add must update pools first

Lines of code Vulnerability details The MasterChef.add function changes the total pool allocation but does not update other pools first. When other pools are finally updated at some point, then accConcurPerShare will be wrongly computed with their smaller allocPoint / newTotalAllocPoint share eve...

CVE-2021-34073

A Cross Site Scripting XSS vulnerabilty exists in Sourcecodester Gadget Works Online Ordering System in PHP/MySQLi 1.0 via the Category parameter in an add function in category/index.php...

CVE-2021-46025

A Cross SIte Scripting XSS vulnerability exists in OneBlog = 2.2.8. via the add function in the operation tab list in the background...

CVE-2021-46025

A Cross SIte Scripting XSS vulnerability exists in OneBlog = 2.2.8. via the add function in the operation tab list in the background...

CVE-2021-46025

The CVE-2021-46025 entry describes a Cross-Site Scripting (XSS) vulnerability in OneBlog

CVE-2021-46025: Improper Neutralization of Input During Web Page Generation

A Cross SIte Scripting XSS vulnerability exists in OneBlog = 2.2.8. via the add function in the operation tab list in the background...

PT-2022-12510

Name of the Vulnerable Software and Affected Versions OneBlog versions prior to 2.2.9 Description A Cross Site Scripting XSS issue exists via the add function in the operation tab list in the background. Recommendations For OneBlog versions prior to 2.2.9, update to version 2.2.9 or later to...

Remote Code Execution (RCE)

aaptjs is vulnerable to remote code execution. The vulnerability exists because of lack of sanitization of user-provided data in the add function, allowing an attacker to provide malicious code via its filePath parameter...

Code injection

An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code via the filePath parameter...

CVE-2020-26707

An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code via the filePath parameter...

Shenzhim Aaptjs operating system command injection vulnerability

aaptjs is a node wrapper for aapt. aaptjs version 1.3.1 has a remote code execution vulnerability in the add function. An attacker can exploit this vulnerability to execute arbitrary code via the filePath parameter...

CVE-2020-26707: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code via the filePath parameter...

PT-2021-11263

Name of the Vulnerable Software and Affected Versions: Shenzhim AAPTJS version 1.3.1 Description: An issue was discovered in the add function that allows attackers to execute arbitrary code via the filePath parameter. Recommendations: For Shenzhim AAPTJS version 1.3.1, consider restricting access...

Cross site scripting

Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting XSS vulnerability in the Displayname field when using the Add, Edit or Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML...

CVE-2020-23049: Improper Neutralization of Input During Web Page Generation

Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting XSS vulnerability in the Displayname field when using the Add, Edit or Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML...

CVE-2021-42329

The “ListAdd” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks...

CVE-2021-25935

In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the...

PT-2021-16865

Name of the Vulnerable Software and Affected Versions OpenNMS Horizon versions opennms-17.0.0-1 through opennms-27.1.0-1 OpenNMS Meridian versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1 OpenNMS Meridian versions meridian-foundation-2020.1.0-1 through...