Trace Financial CRESTBridge 跨站脚本漏洞

CRESTBridge is a resilient, feature-rich interface for Trace Financial.A cross-site scripting vulnerability exists in Trace Financial CRESTBridge, which can be exploited by attackers to execute client-side code...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-40769)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab tha...

Parvan Dobrev scimono 注入漏洞

Parvan Dobrev scimono is Parvan Dobrev an open source application . A server-side and a client-side are provided. Parvan Dobrev scimono suffers from an injection vulnerability, which stems from incorrect innocuous handling of input, where an unauthenticated attacker could inject specially designe...

Accela Civic Platform 跨站脚本漏洞

Accela Civic Platform is a cloud-based solution for Accela's applications to modernize city systems for land management and code enforcement, increased citizen engagement and mobile information access. The vulnerability stems from the lack of proper validation of client-side data by the WEB...

PageLayer Cross-Site Scripting Vulnerability

PageLayer is a WordPress page builder plugin. It is very easy to use and lightweight on the browser. A cross-site scripting vulnerability exists in PageLayer, which stems from a lack of proper validation of client-side data in PageLayer prior to 1.3.5. An attacker can exploit this vulnerability t...

CVE-2021-32671

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 our last beta before v1.0.0 and was not noticed or documented. This allowed for any user to type...

PageLayer 跨站脚本漏洞

PageLayer is a WordPress page builder plugin. It is very easy to use and lightweight on the browser. A cross-site scripting vulnerability exists in PageLayer, which stems from a lack of proper validation of client-side data in PageLayer prior to 1.3.5. An attacker can exploit this vulnerability t...

WordPress plugin cross-site scripting vulnerability (CNVD-2021-41081)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the...

Sifchain: Cross-site Scripting (XSS) possible at https://sifchain.finance// via CVE-2019-8331 exploitation

Summary: https://sifchain.finance is using Bootstrap framework version 4.0.0 which is =4.0.0 4. Visit https://sifchain.finance/wp-content/themes/icos/assets/js/vendor/bootstrap.min.js?ver=5.7.2 5. You'll get the Bootstrap Version, Which is v4.0.0 and its vulnerable to Cross-site Scripting XSS...

noobaa-core cross-site scripting vulnerability

noobaa-core is the application that provides an S3 object storage interface with flexible tiering, mirroring, and distributed placement policies for any storage resource that allows GET/PUT, including S3, GCS, Azure Blob File System, and more. A cross-site scripting vulnerability exists in...

Classic Buffer Overflow in chatwoot/chatwoot

You can put a very long work email text until you get the last user to put and aries or DoS. Normally emails have 64 to 225 digits. Summary There is no limit to the number of characters in the work email, which allows a DoS attack. The DoS attack affects both server-side and client-side. NOTE: Th...

nooba -core 跨站脚本漏洞

noobaa-core is the application that provides an S3 object storage interface with flexible tiering, mirroring, and distributed placement policies for any storage resource that allows GET/PUT, including S3, GCS, Azure Blob File System, and more. A cross-site scripting vulnerability exists in...

CVE-2021-24331

The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings, such as psbdistance, psbbuttonsize, psbspeed, only validating them client side. This could allow high privilege users such as admin to set XSS payloads in them...

CHIYU科技BF-630W 跨站脚本漏洞

BF-630W is a web-based fingerprint-secured single-door biometric reader controller from CHIYU Technology CHIYU Technology suffers from a cross-site scripting vulnerability that stems from an unauthenticated XSS vulnerability in several CHIYU Technology IoT devices, including BF-630, BF-450M,...

The vulnerability of the virtual learning environment Moodle, related to the lack of protection for the website structure, allows a hacker to execute arbitrary HTML code and script code in the user’s browser within the context of the vulnerable website.

The vulnerability of the virtual learning environment Moodle is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary HTML code and script code in the user’s browser, within the context of the...

Haxx libcurl 加密问题漏洞

HAXX Haxx libcurl is a free, open source client-side URL transport library from the Swedish company HAXX. The library supports FTP, FTPS, TFTP, HTTP and more. Haxx libcurl suffers from a cryptographic issue vulnerability that stems from the fact that libcurl allows applications to specify a...

Apple Safari 跨站脚本漏洞

Apple Safari is a web browser from Apple, Inc. and is the default browser that comes with Mac OS X and iOS operating systems. A cross-site scripting vulnerability exists in Apple Safari. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attack...

Mediat 跨站脚本漏洞

Mediat is a responsive media CMS. A cross-site scripting vulnerability exists in Mediat version 1.4.1, which stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerability to inject malicious JavaScript code to steal user credentials...

Cross-site Scripting (XSS) - Generic in utmsigep/member-directory

✍️ Description Non-administrative functions display success banners after multiple actions that reflect user-input directly without sanitization. 🕵️‍♂️ Proof of Concept Donation Creation and Update - Donations - New Donation - Enter XSS payloads into the fields Last Name, First Name and Receipt ID,...

Cross-site Scripting (XSS) - Generic in utmsigep/member-directory

✍️ Description Administrative functions display success banners after multiple actions that reflect user-input directly without sanitization. 🕵️‍♂️ Proof of Concept Member-status Creation and Update - Directory Admin - Member Statuses - Create New Member Status - Code: Enter a string, Label: Enter...