CVE-2022-31297

CVE-2022-31297 Haraj Script 3.7 - XSS المنعكس عنوان الاستغلال: Haraj Script 3.7 - XSS المنعكس التاريخ: 2022-06-13 CVE: CVE-2022-31297 مؤلف الاستغلال: Abdulaziz Saad @b4zb0z الصفحة الرئيسية للبائع: https://angtech.org/ رابط البرنامج: https://angtech.org/product/view/3 الإصدار: 3.7 تم الاختبار على:...

ZZcms - Cross-Site Scripting

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. id: CVE-2020-20285 info: name: ZZcms -...

osTicket < 1.12.1 - Cross-Site Scripting

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /admin/ssl-fields/add.php Display Name, Description & Notes field parameters. id: CVE-2018-19751 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains...

EPrints 3.4.2 - Cross-Site Scripting

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. id: CVE-2021-26702 info: name: EPrints 3.4.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: EPrints 3.4.2 contains a reflected cross-site...

FineCMS <=5.0.10 - Cross-Site Scripting

FineCMS through 5.0.10 contains a cross-site scripting vulnerability in controllers/api.php via the function parameter in a c=api&m=data2 request. id: CVE-2017-11629 info: name: FineCMS =5.0.11 which includes a fix for this vulnerability. reference: -...

Grafana <= 6.7.1 - Cross-Site Scripting

Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

ClinicCases 7.3.3 Cross-Site Scripting

ClinicCases 7.3.3 is susceptible to multiple reflected cross-site scripting vulnerabilities that could allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. id: CVE-2021-38704 info: name:...

Spotweb <= 1.5.1 - Cross Site Scripting

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter. id: CVE-2021-40970 info: name: Spotweb = 1.5.1 - Cross Site Scripting author: theamanrawat severity:...

123Solar 1.8.4.5 - Cross-Site Scripting

123Solar 1.8.4.5 is vulnerable to reflected cross-site scripting XSS via the date1 parameter in detailed.php. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. id: CVE-2024-9007 info: name: 123Solar 1.8.4.5 - Cross-Site Scripting author: ritikchaddha...

TP-Link Archer A20 v3 Router - Cross-site Scripting

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. id: CVE-2017-17059 info: name: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress...

CVE-2024-4367-Analysis

CVE-2024-4367 : Exécution arbitraire de JavaScript dans PDF.js Aperçu CVE-2024-4367 est une vulnérabilité critique dans la bibliothèque PDF.js qui permet l'exécution arbitraire de JavaScript dans le navigateur d'un utilisateur, entraînant des attaques de type Cross-Site Scripting XSS. Cela affect...

CVE-2025-29094-Multiple-Stored-Cross-Site-Scripting-XSS

CVE-2025-29094-ثغرات-متعددة-من-نوع-البرمجة-النصية-عبر-المواقع-المخزنة-XSS يكشف هذا المستودع عن ثغرة أمنية تم اكتشافها في نظام إدارة المحتوى Motivian الإصدار 41.0.0. CVE-2025-29094: ثغرات متعددة من نوع البرمجة النصية عبر المواقع المخزنة XSS تم الإبلاغ عن هذه الثغرة للبائع وفقًا لممارسات الإفصاح...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 تقرير ثغرة في الموقع الرسمي لولاية نيوجيرسي Bootstrap 4.0.0 تم العثور عليه في https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js معلومات الثغرة: متوسطة 28236 ثغرة XSS في خصائص data-template وdata-content وdata-title الخاصة بأداتي tooltip وpopover...

CVE-2025-44998

CVE-2025-44998 الملخص ثغرة تخزين للبرمجة النصية عبر المواقع XSS في المكون /tinyfilemanager.php من TinyFileManager الإصدار 2.4.7 تسمح للمهاجمين بتنفيذ أكواد JavaScript أو HTML عشوائية عن طريق حقن حمولة مصمّمة في المعلَمة js-theme-3. إثبات المفهوم PoC للتحقق من الثغرات، انتقل إلى صفحة الإعدادات...

detect-cve-2024-4367

Détecter CVE-2024-4367 Règle de détection YARA rapide et sale pour l'exécution arbitraire de JavaScript dans PDF.js CVE-2024-4367. Utilisation root@kitploit: $ yara explpdfjscve20244367.yar pocgeneralizedCVE-2024-4367.pdf EXPLPDFJSCVE20244367 pocgeneralizedCVE-2024-4367.pdf Crédits POC et...

CVE-2024-42009

CVE-2024-42009 – ثغرة XSS مخزنة في Roundcube PoC باستخدام Docker 📌 نظرة عامة يُظهر هذا المستودع إثبات مفهوم PoC عمليًا لـ CVE-2024-42009 ، وهي ثغرة من نوع Cross-Site Scripting XSS المخزنة في بريد Roundcube الإلكتروني. تحدث الثغرة بسبب تنقية HTML غير صحيحة تتبعها إعادة معالجة غير آمنة للسمات، مما...

CVE-2025-67730

CVE-2025-67730 – Cross-Site Scripting stocké XSS Aperçu ID CVE : CVE-2025-67730 Type de vulnérabilité : Cross-Site Scripting stocké XSS Sévérité : Moyenne–Élevée selon le contexte Cette vulnérabilité permettait à des utilisateurs authentifiés d’injecter du HTML et du JavaScript malveillants dans...