CVE-2020-12625

CVE-2020-12625 : Cross-Site Scripting via une pièce jointe HTML malveillante dans Roundcube Webmail Une vulnérabilité de Cross-Site scripting XSS existe dans les versions de Roundcube antérieures à 1.4.4, 1.3.11 et 1.2.10. En exploitant l'élément XML "" dans un courriel avec une pièce jointe...

CVE-2024-4367-Analysis

CVE-2024-4367: تنفيذ جافا سكربت تعسفي في PDF.js نظرة عامة CVE-2024-4367 هي ثغرة أمنية حرجة في مكتبة PDF.js تسمح بتنفيذ جافا سكربت تعسفي في متصفح المستخدم، مما يؤدي إلى هجمات Cross-Site Scripting XSS. تؤثر هذه الثغرة على Firefox مثال: python3 poc.py "alert1" فيديوهات العرض التوضيحي...

osTicket < 1.12.1 - Cross-Site Scripting

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /admin/ssl-fields/add.php Display Name, Description & Notes field parameters. id: CVE-2018-19751 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains...

ZZcms - Cross-Site Scripting

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. id: CVE-2020-20285 info: name: ZZcms -...

EPrints 3.4.2 - Cross-Site Scripting

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. id: CVE-2021-26702 info: name: EPrints 3.4.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: EPrints 3.4.2 contains a reflected cross-site...

FineCMS <=5.0.10 - Cross-Site Scripting

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...

ClinicCases 7.3.3 Cross-Site Scripting

ClinicCases 7.3.3 is susceptible to multiple reflected cross-site scripting vulnerabilities that could allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. id: CVE-2021-38704 info: name:...

Spotweb <= 1.5.1 - Cross Site Scripting

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter. id: CVE-2021-40970 info: name: Spotweb = 1.5.1 - Cross Site Scripting author: theamanrawat severity:...

Grafana <= 6.7.1 - Cross-Site Scripting

Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

123Solar 1.8.4.5 - Cross-Site Scripting

123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting XSS via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2024-9007 info: name: 123Solar 1.8.4.5 - Cross-Site Scripting author: ritikchaddha...

TP-Link Archer A20 v3 Router - Cross-site Scripting

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. id: CVE-2017-17059 info: name: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress...

CVE-2025-67730

CVE-2025-67730 – Межсайтовый скриптинг XSS с сохранением Обзор CVE ID: CVE-2025-67730 Тип уязвимости: Межсайтовый скриптинг XSS с сохранением Серьёзность: Средняя–Высокая зависит от контекста Данная уязвимость позволяла аутентифицированным пользователям внедрять вредоносный HTML и JavaScript в по...

CVE-2022-31297

CVE-2022-31297 Haraj Script 3.7 - Reflected XSS शोषण शीर्षक: Haraj Script 3.7 - Reflected XSS तारीख: 2022-06-13 CVE: CVE-2022-31297 शोषण लेखक: Abdulaziz Saad @b4zb0z विक्रेता होमपेज: https://angtech.org/ सॉफ्टवेयर लिंक: https://angtech.org/product/view/3...

CVE-2025-44998

CVE-2025-44998 Riepilogo Una vulnerabilità di cross-site scripting XSS memorizzato nel componente /tinyfilemanager.php di TinyFileManager v2.4.7 consente agli attaccanti di eseguire JavaScript o HTML arbitrario iniettando un payload appositamente creato nel parametro js-theme-3. PoC Per verificar...

CVE-2024-42009

CVE-2024-42009 – XSS Memorizzato in Roundcube PoC Docker 📌 Panoramica Questo repository dimostra un Proof-of-Concept PoC funzionante per CVE-2024-42009 , una vulnerabilità di Cross-Site Scripting XSS memorizzata in Roundcube Webmail. La vulnerabilità è causata da una sanitizzazione HTML impropria...

Hacking-pdf.js-vulnerability

🚨 CVE-2024-4367: Esecuzione Arbitraria di JavaScript in PDF.js Questo progetto dimostra e analizza CVE-2024-4367 , una vulnerabilità ad alta gravità nella libreria PDF.js di Mozilla che permette l'esecuzione arbitraria di JavaScript attraverso un controllo inadeguato dei tipi nel codice di gestio...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Report di vulnerabilità del sito ufficiale del New Jersey Bootstrap 4.0.0 Trovato in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Informazioni sulla vulnerabilità: Media 28236 XSS nelle proprietà data-template, data-content e data-title di...