CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2020-57873)

CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS Made...

PHPEMS online practice exam system suffers from XSS vulnerability (CNVD-2020-58416)

PHPEMS online mock exam system is an online exam simulation system, PHPEMS PHP Exam Management System online mock exam system based on PHP + Mysql development, support for a variety of types of questions and ways to show, is the first to support the question of the question and the hand of the...

GLPI Cross-Site Scripting Vulnerability (CNVD-2020-67240)

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

Swordfish forum cms has XSS vulnerability

Swordfish Forum System is a light forum system, officially developed and released by Catfish CMS. Swordfish forum cms has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...

CVE-2020-23832

A Persistent Cross-Site Scripting XSS vulnerability in messageadmin.php in Projectworlds Car Rental Management System v1.0 allows unauthenticated remote attackers to harvest an admin login session cookie and steal an admin session upon an admin login...

CVE-2020-24860

CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website...

CVE-2020-25761

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc...

Input validation

Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies,sensitive information etc...

bootstrap: XSS in the affix configuration target property

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the affix configuration target property. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hostin...

bootstrap: XSS in the tooltip data-viewport attribute

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the tooltip data-viewport attribute. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hosting W...

Anchor CMS Stored Cross-Site Scripting Vulnerability

Anchor CMS is a content management system. Anchor CMS stored cross-site scripting vulnerability. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...

XSS Vulnerability in Situ CMS

Situ CMS is the short name of Situ Tourism Website Management System, which is a self-developed website management system applicable to the construction of tourism websites. An XSS vulnerability exists in SITO CMS, which can be exploited by attackers to obtain an administrator cookie...

ovirt-engine: Reflected cross site scripting vulnerability

A flaw was found in the web interface of ovirt-engine 4.4.2 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user's cookies or other...

CVE-2020-4315

IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...

Authorization

IBM Business Automation Content Analyzer on Cloud 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to th...

CVE-2020-4315

This CVE (CVE-2020-4315) affects IBM Business Automation Content Analyzer on Cloud 1.0. The vulnerability arises because the authorization tokens or session cookies do not set the Secure attribute, allowing cookies to be exposed when a user visits an http link, enabling an attacker to snoop traff...

Design/Logic Flaw

An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2. Unrestricted HTTP header reflection in Gradle Enterprise allows remote attackers to obtain authentication cookies, if they are able to discover a separate XSS vulnerability. This...

CVE-2020-24924

A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...

WordPress Click To Top Plugin Stored Cross-Site Scripting Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A stored cross-site scripting vulnerability exists in the WordPress Click To Top plugin. An...

Stored cross-site scripting vulnerability in ZZCMS as***.php page

ZZCMS is a free website builder developed in asp language. A stored cross-site scripting vulnerability exists in the ZZCMS as.php page. An attacker can exploit the vulnerability to obtain a background administrator cookie...