CVE-2021-38113

In addBouquet in js/bqe.js in OpenWebif aka e2openplugin-OpenWebif through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor i.e., bouqueteditor/api/addbouquet?name= leads to Stored XSS...

Cross site scripting

In addBouquet in js/bqe.js in OpenWebif aka e2openplugin-OpenWebif through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor i.e., bouqueteditor/api/addbouquet?name= leads to Stored XSS...

e2openplugin-OpenWebif 跨站脚本漏洞

OpenWebif is an open source web interface for Enigma2 based set-top boxes. A cross-site scripting vulnerability exists in e2openplugin-OpenWebif versions prior to 1.4.7, which originates from the addBouquet module in js/bqe.js, where insertion of JavaScript into the Bouquet Editor's Add Bouquet...

CVE-2021-33336: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Journal module's add article menu in Liferay Portal 7.3.0 through 7.3.3, and Liferay DXP 7.1 fix pack 18, and 7.2 fix pack 5 through 7, allows remote attackers to inject arbitrary web script or HTML via the comliferayjournalwebportletJournalPortletnam...

CVE-2021-36702

The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting XSS vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through...

CVE-2021-36702

CVE-2021-36702 affects htmly 2.8.1. The vulnerability is a stored XSS in the content field of the ”regular post” → “add content” page in the dashboard. It allows an attacker who can issue authenticated POST requests to add/content to inject arbitrary HTML/ scripts, enabling cross-site script exec...

htmly 跨站脚本漏洞

htmly is a simple and fast database-free PHP blogging platform and flat file CMS. htmly version 2.8.1 has a vulnerability in the "content" field of the "regular post" page in the "add content" menu of the dashboard. field of the "add content" menu in the dashboard is vulnerable to a stored...

CVE-2021-36702: Improper Neutralization of Input During Web Page Generation

The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting XSS vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through...

CVE-2021-32811

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional...

CVE-2021-3351

OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page...

CVE-2021-3351

OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page...

CVE-2021-3351

OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page...

OpenPLC 跨站脚本漏洞

OpenPLC is an open source programmable logic controller. It can provide low-cost industrial solutions for automation and research. A cross-site scripting vulnerability exists in OpenPLC runtime V3, which stems from the Device Name on the Add New Device page of the product failing to properly...

CVE-2021-3351: Improper Neutralization of Input During Web Page Generation

OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page...

CVE-2020-18013

SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?adminbanned/add.htm...

S-CMS 跨站脚本漏洞

S-CMS is a product developed by Zibo Shining Network Technology Co., Ltd. that provides solutions for building enterprise websites. /app/formadd/ in S-CMS 3.0 has a stored cross-site scripting vulnerability that can be exploited to execute arbitrary Web scripts or HTML via the title entry text bo...

VulnCheck KEV: CVE-2020-36195

An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedi...

uListing < 2.0.6 - Multiple CSRF

The plugin is lacking proper CSRF checks in multiple protected actions within wp-admin pages, leaving them vulnerable to CSRF attacks. PoC | CSRF | Add/Edit Pricing Plans: POST /wp-admin/admin-ajax.php HTTP/2 Host: example.com Cookie: agent or admin cookies User-Agent: Mozilla/5.0 Content-Type:...

CVE-2021-25203

Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\adminaddpost.php...

Vehicle Parking Management System 1.0 Cross Site Scripting

Exploit Title: Vehicle Parking Management System - Stored Cross-Site-Scripting XSS Date: 2021-07-09 Exploit Author: faisalfs10x https://github.com/faisalfs10x Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/vehicle-parking-management-system-using-php-and-mysql/...