7778 matches found
CVE-2024-46226
A stored cross site scripting XSS vulnerability in HelpDeskZ v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket...
CVE-2024-46226
A stored cross site scripting XSS vulnerability in HelpDeskZ v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket...
CVE-2024-13494
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data...
Cross-site Scripting (XSS)
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the site administration live log. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker āinjectsā a malicious script into an...
CVE-2025-26529
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk...
UBUNTU-CVE-2025-26529
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk...
CVE-2025-26529
CVE-2025-26529 affects Moodle, with the root cause a vulnerability in how Description information is displayed in the site administration live log, requiring additional sanitizing to prevent stored XSS. The entry is evidenced across multiple feeds, including a GitHub PoC claiming a Moodle XSS to ...
CVE-2025-26529 Stored XSS risk in admin live log
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk...
CVE-2025-26529 Stored XSS risk in admin live log
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk...
Trump 2.0 Brings Cuts to Cyber, Consumer Protections
One month into his second term, President Trump's actions to shrink the government through mass layoffs, firings and withholding funds allocated by Congress have thrown federal cybersecurity and consumer protection programs into disarray. At the same time, agencies are battling an ongoing effort ...
CVE-2025-1024
A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting XSS in the EditEventAttendees.php page. This requires Administration privileges and affects the EID parameter. The flaw allows an attacker to...
CVE-2025-1024 Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter
A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting XSS in the EditEventAttendees.php page. This requires Administration privileges and affects the EID parameter. The flaw allows an attacker to...
PT-2025-7686
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description Insufficient sanitization of description information displayed in the site administration live log allows a remote attacker to perform a stored Cross-Site Scripting XSS attack. Stored XSS occu...
CVE-2024-13608 Track Logins <= 1.0 - Admin+ SQL Injection
The Track Logins WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2025-1335
A vulnerability, which was classified as problematic, was found in CmsEasy 7.7.7.9. Affected is the function deleteimgaction in the library lib/admin/fileadmin.php. The manipulation of the argument imgname leads to path traversal. It is possible to launch the attack remotely. The exploit has been...
CVE-2024-47264
Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in agent-related functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to delete arbitrary files...
PT-2025-7057 Ā· Nitrokey Ā· Nitrokey 3 Firmware
Name of the Vulnerable Software and Affected Versions: Nitrokey 3 Firmware versions 1.8.0 and prior test releases with PIV enabled Description: The PIV application in the Nitrokey 3 Firmware could accept invalid keys for authentication of the admin key, potentially compromising the integrity of t...
Siemens SIMATIC PCSåSiemens TIA Administrator 代ē é®é¢ę¼ę“
Siemens TIA Administrator and Siemens SIMATIC PCS are both products of Siemens, Germany.Siemens TIA Administrator is a management program for authorizing and licensing SIMATIC products.Siemens SIMATIC PCS is a Siemens SIMATIC PCS is a process control system. A code issue vulnerability exists in...
trojan å®å Øę¼ę“
trojan is a multi-user administration and deployment program by Jrohy Individual Developer, supporting web page administration. A security vulnerability exists in trojan versions v.2.0.0 through v.2.15.3, which is caused by elevation of privilege via the initialization interface /auth/register...
CVE-2021-35653
Vulnerability in the Essbase Administration Services product of Oracle Essbase component: EAS Console. The supported versions that are affected are Prior to 11.1.2.4.046 and Prior to 21.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...