Dom XSS in Add Question

Description Evil users can attack other users or administrator users through this vulnerability, causing other users/administrator user accounts to be taken over Proof of Concept step1. Add a normal user and log in step2. Add a new question and insert xss payload in the body Step3. Login admin us...

CVE-2022-43972

A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware = 4.30.18.006. A null pointer dereference in the soapaction function within the upnp binary can be triggered by an unauthenticated attacker via a malicious POST request invoking the...

PT-2023-14414 · Linksys · Linksys Wrt54Gl Wireless-G Broadband Router

Name of the Vulnerable Software and Affected Versions: Linksys WRT54GL Wireless-G Broadband Router versions = 4.30.18.006 Description: A null pointer dereference issue exists in the soap action function within the upnp binary. This can be triggered by an unauthenticated attacker via a malicious...

angular-test-reporter SQL注入漏洞

angular-test-reporter is an application for publishing and viewing automated test results by Grant Person Personal Developer. A SQL injection vulnerability exists in angular-test-reporter that originates in the function getProjectTables/addTest in the file rest-server/data-server.js, which operat...

Stored XSS in Add new question

Description Stored cross-site scripting also known as second-order or persistent XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. steps 1-log in as an admin user first. 2-go to :...

PT-2023-10121 · Himiklab · Yii2-Jqgrid-Widget

Name of the Vulnerable Software and Affected Versions: himiklab yii2-jqgrid-widget versions up to 1.0.7 Description: A critical issue affects the addSearchOptionsRecursively function of the file JqGridAction.php, leading to sql injection. Recommendations: For himiklab yii2-jqgrid-widget versions ...

CVE-2022-47661

GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 is vulnerable to Buffer Overflow via mediatools/avparsers.c:4988 in gfmedianaluaddemulationbytes...

Cross-Site Request Forgery (CSRF)

github.com/usememos/memos is vulnerable to cross-site request forgery. An attacker is able to add new members with any role, via the user API, which allows the attacker to takeover memos application with HOST role...

PT-2023-10102 · Unknown · Porpeeranut Go-With-Me

Name of the Vulnerable Software and Affected Versions: porpeeranut go-with-me affected versions not specified Description: A critical issue has been identified, affecting an unknown functionality of the file module/frontend/add.php, which leads to sql injection. Recommendations: To resolve this...

PT-2025-54014

Name of the Vulnerable Software and Affected Versions linux affected versions not specified Description The Linux kernel contains an issue within the btrfs subsystem related to error handling in the add new free space function. The function previously included BUG ON checks to handle potential...

PT-2023-13359 · Sage · Sage Xrt Business Exchange

Name of the Vulnerable Software and Affected Versions: Sage XRT Business Exchange version 12.4.302 Description: The issue allows an authenticated attacker to inject malicious data in SQL queries, specifically in the following areas: Add Currencies, Payment Order, and Transfer History...

CVE-2022-34324

Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment Order, and Transfer History...

PT-2025-54066

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the networking component, specifically within the smc SMC subsystem. A potential panic can occur due to a lack of protection in the smc llc srv add li...

PT-2025-54167

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc3+ Description The Linux kernel contains a flaw in the driver core, specifically a potential null-pointer dereference in the device add function. This issue occurs when a device is added, and an error...

Cross-Site Request Forgery (CSRF) in Add Users

Description Hello Team, Create a member functionality is vulnerable for CSRF Attack , by exploiting CSRF vulnerability , attacker can add new Members history.pushState'', '', '/' POC video: https://drive.google.com/file/d/1dN2ug8qjwbz1CGbfuBldwamIFE4BNyH/view?usp=sharing Fix: I just want to sugge...

APT Hackers Turn to Malicious Excel Add-ins as Initial Intrusion Vector

Microsoft's decision to block Visual Basic for Applications VBA macros by default for Office files downloaded from the internet has led many threat actors to improvise their attack chains in recent months. Now according to Cisco Talos, advanced persistent threat APT actors and commodity malware...

CVE-2022-47968

Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page...

Cross site scripting

Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page...

PT-2022-28097 · Unknown · Heimdall Application Dashboard

Name of the Vulnerable Software and Affected Versions: Heimdall Application Dashboard versions 2.5.4 and earlier Description: The issue allows for reflected and stored Cross-Site Scripting XSS attacks via the Application name variable to the "Add application" page. The stored XSS will be triggere...

Dropbox Merou 注入漏洞

Dropbox Merou is an open source Dropbox application that allows users to create and manage their group memberships. Dropbox Merou suffers from an injection vulnerability that stems from a problem with the addpublickey function in the grouper/publickey.py file in the component SSH Public Key...