Grupo Crk Banking Business Platform Cross-Site Scripting Vulnerability

Grupo Crk Banking Business Platform is a business management software from Grupo Crk, Portugal. A cross-site scripting vulnerability exists in CRK Business Platform version 2019.1 and prior versions, which stems from the application lacking proper validation of client-side data CRK, IDContratante...

CVE-2020-24683

The affected versions of S+ Operations version 2.1 SP1 and earlier used an approach for user authentication which relies on validation at the client node client-side authentication. This is not as secure as having the server validate a client application before allowing a connection. Therefore, i...

Authentication flaw

The affected versions of S+ Operations version 2.1 SP1 and earlier used an approach for user authentication which relies on validation at the client node client-side authentication. This is not as secure as having the server validate a client application before allowing a connection. Therefore, i...

CVE-2020-24683 Authentication Bypass in Symphony Plus

The affected versions of S+ Operations version 2.1 SP1 and earlier used an approach for user authentication which relies on validation at the client node client-side authentication. This is not as secure as having the server validate a client application before allowing a connection. Therefore, i...

CVE-2020-26177

In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibit...

CVE-2020-26174

tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser client-side and can be circumvented. This allows an attacker to upload any file as an...

CVE-2020-26174

tangro Business Workflow before 1.18.1 requests a list of allowed filetypes from the server and restricts uploads to the filetypes contained in this list. However, this restriction is enforced in the browser client-side and can be circumvented. This allows an attacker to upload any file as an...

Tangro Business Workflow 代码问题漏洞

Tangro Business Workflow is a German Tangro company's internal control of the contents of SAP documents and the approval process for the visual drawing of the software. A code issue vulnerability exists in tangro Business Workflow versions prior to 1.18.1, which stems from requesting a list of...

Seotoaster 3.2.0 Cross Site Scripting

Exploit Title: Seotoaster 3.2.0 - Stored XSS on Edit page properties Exploit Author: Hardik Solanki Vendor Homepage: https://www.seotoaster.com/ Software Link: https://crm-marketing-automation-platforms.seotoaster.com/ Version: 3.2.0 Tested on Windows 10 XSS ATTACK: Cross-site Scripting XSS is a...

Sourcecodester Alumni Management System 跨站脚本漏洞

Sourcecodester Alumni Management System is an alumni management system. Sourcecodester Alumni Management System suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in the web application, which can be exploited by an attacker to...

Seotoaster 3.2.0 - Stored XSS on Edit page properties

Exploit Title: Seotoaster 3.2.0 - Stored XSS on Edit page properties Exploit Author: Hardik Solanki Vendor Homepage: https://www.seotoaster.com/ Software Link: https://crm-marketing-automation-platforms.seotoaster.com/ Version: 3.2.0 Tested on Windows 10 XSS ATTACK: Cross-site Scripting XSS is a...

CVE-2020-25195

The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device...

Input validation

The length of the input fields of Host Engineering H0-ECOM100, H2-ECOM100, and H4-ECOM100 modules are verified only on the client side when receiving input from the configuration web server, which may allow an attacker to bypass the check and send input to crash the device...

CVE-2020-25195

CVE-2020-25195 affects Host Engineering ECOM100 modules (H0-ECOM100, H2-ECOM100, H4-ECOM100). The vulnerability arises because input field length checks are enforced only on the client side when inputs come from the configuration web server, allowing an attacker to bypass the check and send input...

S-cart Cross-Site Scripting Vulnerability

S-cart is a Php-based e-commerce management platform from the S-cart community. A cross-site scripting vulnerability exists in s-cart core before version 4.4, which stems from a lack of detection of client-side input in the search function of the admin dashboard in...

Stripo Inc: Permanent DOS for new users!

Summary: Hi team its me Akash Hamal, and while testing my.stripo.email website which is in scope of your program i was able to DOS permanently any new mail,user which might use your service in future but they won't be able to use ! While registration on my.stripo.email there are three fields...

SourceCodester Online Examination System Cross-Site Scripting Vulnerability (CNVD-2021-95923)

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. A cross-site scripting vulnerability exists in SourceCodester Online Examination System 1.0, which stems from a WEB application's lack of proper validation of The vulnerability is caused by the lack...

SourceCodester Online Examination System Cross-Site Scripting Vulnerability (CNVD-2021-95922)

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. A cross-site scripting vulnerability exists in SourceCodester Online Examination System, which originates from the q parameter does not filter user input, which can be exploited to execute JavaScrip...

Host Engineering Ecom100 Module Input Validation Error Vulnerability

The Host Engineering Ecom100 Module is a programmable controller for industrial environments from Host Engineering, USA. The device can be installed with the DirectSoft software package for PLC programming, and the master and slave configurations support the Modbus/Tcp protocol. An input validati...

SourceCodester Online Examination System 跨站脚本漏洞

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. A cross-site scripting vulnerability exists in SourceCodester Online Examination System 1.0, which stems from a WEB application's lack of proper validation of The vulnerability is caused by the lack...