6334 matches found
PT-2022-13363 · Parse-Url +2 · Url-Parse +2
Name of the Vulnerable Software and Affected Versions: url-parse versions prior to 1.5.9 Description: The issue arises from leading control characters in a URL not being stripped when passed into url-parse, potentially causing input URLs to be mistakenly interpreted as relative URLs without a...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on PHP and MySQL servers. wordpress WOOCS has a cross-site scripting vulnerability that stems from the product's failure to effectively handle...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload. Details Cross-site scripting or XSS is a co...
in microweber/microweber
Description There is no input field length in update username where any user can able to add large number of characters like imagine we can add more 5000+ character on to the update name field . Steps to Reproduce Visit the particular URL Vulnerable-link Where there is a functionality to update o...
CVE-2022-25235
xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context...
CVE-2022-25236
xmlparse.c in Expat aka libexpat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs...
EUVD-2022-29934
xmlparse.c in Expat aka libexpat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs...
CVE-2022-25236
xmlparse.c in Expat aka libexpat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs...
Pybbs Cross-Site Scripting Vulnerability
Pybbs is a community forum for more practical Java development. A cross-site scripting vulnerability exists in Pybbs, which stems from the product's search box not effectively handling special characters in user input data. An attacker can exploit this vulnerability to execute client-side code...
Tongda2000 SQL Injection Vulnerability
A SQL injection vulnerability exists in Tongda2000, a web-based intelligent office system from China Tongda, which originates from the dname parameter in the product's exportdata.php file that does not securely handle special characters in user input data. An attacker can execute malicious SQL...
Microweber command injection vulnerability
Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. A command injection vulnerability exists in Microweber, which stems from the failure of the...
CVE-2022-25236
xmlparse.c in Expat aka libexpat before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs...
netty: control chars in header names may lead to HTTP request smuggling
A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling...
Pybbs 跨站脚本漏洞
Pybbs is a community forum for more practical Java development. A cross-site scripting vulnerability exists in Pybbs, which stems from the product's search box not effectively handling special characters in user input data. An attacker can exploit this vulnerability to execute client-side code...
Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-22706)
Pimcore is an open source Web content management platform for creating and managing Web applications from Pimcore Austria. The platform integrates Web content management, e-commerce frameworks and product information management applications.Pimcore has a cross-site scripting vulnerability that...
Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-22707)
Pimcore is an open source Web content management platform for creating and managing Web applications from Pimcore Austria. The platform integrates Web content management, e-commerce frameworks and product information management applications.Pimcore has a cross-site scripting vulnerability that...
Gitea Cross-Site Scripting Vulnerability (CNVD-2022-11525)
A cross-site scripting vulnerability exists in Gitea, a Go-based lightweight git service developed by the Gitea community. The vulnerability stems from a mirror setting in the product wiki/issue link that does not effectively handle special characters in the input data. An attacker could execute...
CVE-2021-26616
An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments...
