Page Generator Plugin < 1.6.5 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Got to Page Generator - Keywords - Add Keyword and put the following payload in the "Terms" field then...

add-celle.de Cross Site Scripting vulnerability OBB-2683425

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The vulnerability of the add-directory.php component of the Directory Management System allows a hacker to execute arbitrary SQL commands.

The vulnerability of the add-directory.php component of the Directory Management System relates to the ability to execute commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely, using the fullname parameter...

CVE-2022-33028

LibreDWG v0.12.4.4608 was discovered to contain a heap buffer overflow via the function dwgaddobject at decode.c...

74cms 跨站脚本漏洞

74cms is a PHP and MySQL-based online recruitment system from China Xunyi Technology Company. 74cmsSE version v3.5.1 contains a cross-site scripting vulnerability, which originates from the path /company/service/increment/add/im missing data validation filters for user-supplied data and output. A...

PT-2022-21656 · Libredwg · Libredwg

Name of the Vulnerable Software and Affected Versions: LibreDWG version 0.12.4.4608 Description: The issue is related to a heap buffer overflow. It occurs via the function dwg add object at decode.c. Recommendations: For LibreDWG version 0.12.4.4608, consider disabling the dwg add object function...

PT-2022-21655 · Libredwg · Libredwg

Name of the Vulnerable Software and Affected Versions: LibreDWG version 0.12.4.4608 Description: A heap-use-after-free issue was discovered in LibreDWG, which occurs via the dwg add handleref function at dwg.c. Recommendations: For LibreDWG version 0.12.4.4608, consider restricting access to the...

CVE-2022-23072

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

CVE-2022-23072

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

Cross site scripting

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

CVE-2022-23072

CVE-2022-23072 : In Recipes (versions 1.0.5–1.2.5), a Stored XSS flaw exists in the Add to Cart flow. An attacker can inject a malicious payload via the Name parameter on the food list page, triggering the XSS when adding to the shopping cart. This could enable the attacker to capture the victim’...

CVE-2022-23072 Recipes - Stored XSS in Add to Cart

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

CVE-2022-23072 Recipes - Stored XSS in Add to Cart

In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting XSS, in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an X...

Duplicate token can be added to MasterChef

Lines of code Vulnerability details Impact MasterChefV2.add does not check if the lpToken is previously added. This would lead to incorrect accounting of lpToken in different pid. Proof of Concept function adduint256 allocPoint, IERC20 lpToken, IRewarder rewarder public onlyOwner uint256...

Malicious code in rc-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f276516a3eaa094c2646799cee2b0c4e2c604ed70d1d512e7168e91c99a808b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5603 Malicious code in rc-add-in-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2970478b3b25a1b749b4e4c2cd0d0f5a97316b27bf5cb5cb07dde2c6002014d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5602 Malicious code in rc-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f276516a3eaa094c2646799cee2b0c4e2c604ed70d1d512e7168e91c99a808b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5407 Malicious code in poll-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc694fc37edc42eafa5a430d831b549c43843b033109b3b63e7c09548a786e54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in poll-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc694fc37edc42eafa5a430d831b549c43843b033109b3b63e7c09548a786e54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sc-add-to-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5257c8252b296dd5d8b693935047369934e120b7e0c18c6497b922fb174455c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...