4images 1.7.11 Cross Site Scripting

Exploit Title: 4images v1.7.11 - 'Profile Image' Stored Cross-Site Scripting Date: 30-12-2020 Exploit Author: Ritesh Gohil Vendor Homepage: https://www.4homepages.de/ Software Link: https://www.4homepages.de/download-4images Version: 1.7.11 Tested on: Windows 10/Kali Linux Vulnerable Parameters:...

CVE-2020-25797

LimeSurvey 3.21.1 is affected by cross-site scripting XSS in the Add Participants Function First and last name parameters. When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser...

Cross site scripting

LimeSurvey 3.21.1 is affected by cross-site scripting XSS in the Add Participants Function First and last name parameters. When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser...

CVE-2020-25797

LimeSurvey 3.21.1 is affected by cross-site scripting XSS in the Add Participants Function First and last name parameters. When the survey participant being edited, e.g. by an administrative user, the JavaScript code will be executed in the browser...

CVE-2020-25797

LimeSurvey 3.21.1 is affected by cross-site scripting (XSS) in the Add Participants Function (First and last name parameters). The vulnerability arises when an administrative user edits a participant, causing injected JavaScript to execute in the browser. Multiple connected sources corroborate th...

PT-2020-10894 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: NetBox versions 2.6.2 and earlier Description: The issue allows an authenticated user to conduct a cross-site scripting XSS attack against an admin via a GFM-rendered field. This can be demonstrated by the "/dcim/sites/add/" endpoint,...

PT-2020-16217 · Limesurvey · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey version 3.21.1 Description: The issue concerns cross-site scripting XSS in the Add Participants Function, specifically affecting the First and last name parameters. When a survey participant is being edited, for instance by an...

LimeSurvey 跨站脚本漏洞

limesurvey is an open source online questionnaire program with multiple functions such as questionnaire design, modification, release, recovery and statistics. A cross-site scripting vulnerability exists in the "Add Participant" feature in LimeSurvey 3.21.1. An attacker can exploit this...

CVE-2020-13474

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users...

Cross-site Scripting (XSS)

intelliants/subrion is vulnerable to cross-site scripting XSS. The vulnerability exists through an iframe injection through the page content block in the Add a Page section...

CXUUCMS Cross-Site Request Forgery Vulnerability

CxuuCms is an easy-to-use, open source PHP+Mysql based content management system. CXUUCMS 3.1 suffers from a cross-site request forgery vulnerability. An attacker can add an administrator account via admin.php?c=adminuser&a=add to exploit this vulnerability...

CXUUCMS Cross-Site Scripting Vulnerability (CNVD-2020-75073)

CxuuCms is an easy-to-use, open source PHP+Mysql based content management system. CXUUCMS 3.1 suffers from a reflective cross-site scripting vulnerability. Attackers can use the vulnerability to inject arbitrary Web script or HTML via the imgurl parameter of admin.php?c=content&a=add...

CVE-2020-29204

XXL-JOB 2.2.0 allows Stored XSS in Add User to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java...

CVE-2020-29204

CVE-2020-29204 affects XXL-JOB 2.2.0 with a Stored XSS in the Add User path. The root cause is a bypass of the 20-character limit in xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java, enabling persistent script injection. The NVD and related sources classify the CVSS v3...

XXL-JOB 跨站脚本漏洞

XXL-JOB is a distributed task scheduling platform whose core design goals are rapid development, simple learning, lightweight and easy to extend. A stored cross-site scripting vulnerability exists in XXL-JOB 2.2.0 in the "Add User" section, which can be exploited to bypass a 20-minute vulnerabili...

CVE-2020-35245

Flamingo aka FlamingoIM through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser...

CVE-2020-35346

CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...

CVE-2020-25917

Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" privileges, can perform privileged operations including adding a new administrator to the platform via the easyadmin/user/submitCreateTCUser....

Blizmax Flamingoim SQL Injection Vulnerability

Blizmax Flamingoim is a high-performance, lightweight, open source instant messaging software from the individual developers of Blizmax. A SQL injection vulnerability exists in Blizmax Flamingoim version 2020-09-29 and earlier versions, which stems from UserManager::addUser...

CVE-2020-35274

DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting XSS to gain remote privileges. An attacker could compromise the security of a website or web application through a stored XSS attack and stealing cookies using XSS...