Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in Academy LMS before v5.10 allows an attacker to arbitrarily create a page...

PT-2023-19077 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed versions Description: The issue allows exploitation of embeddable comments to create new topics as any user without a clear title or content. Recommendations: For versions...

Discourse 访问控制错误漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. Discourse suffers from an access control error vulnerability, which can be exploited by an attacker to create new threads as any user with embeddable comments...

PT-2023-1394 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 2.6.0-rc1 through 2.6.0 Description: The issue is related to an output sanitization bug in Argo CD, which leaks repository access credentials in error messages. These error messages are visible to the user and are logged. The...

PT-2025-49753

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 Description The Linux kernel contains a flaw within the hfs module related to reference counting of hfs bnode structures. Specifically, a missing call to hfs bnode get afte...

PT-2023-34918 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.303 Description: The issue is related to an overflow before widen in the bitmap ip create function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

CVE-2023-24065

NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for...

CVE-2023-0571

Summary: CVE-2023-0571 affects SourceCodester Canteen Management System v1.0, specifically the Add Customer component’s createcustomer.php. The vulnerability arises from manipulating the name parameter, enabling cross-site scripting (XSS). Reports indicate remote initiation and public disclosure,...

CVE-2023-24065

The CVE-2023-24065 entry affects NOSH (version 4a5cfdb) and describes a stored XSS vulnerability on the create user page. A crafted first name field can execute JavaScript when visiting /users/2/1, with potential to exfiltrate Protected Health Information in a healthcare-charting context. Public ...

CVE-2023-24065

NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for...

Command Injection in create-choo-electron

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-47073

A cross-site scripting XSS vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter...

Cross site scripting

A cross-site scripting XSS vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter...

Small CRM 跨站脚本漏洞

PHPGurukul Small CRM is a customer relationship management system. A security vulnerability exists in Small CRM v3.0, which stems from the Subject parameter of its Create Ticket page that allows an attacker to inject a crafted payload to execute arbitrary web script and HTML...

Softing uaToolkit Embedded 安全漏洞

Softing UaToolkit Embedded is used to support the development of embedded Opc Ua applications via client/server and publisher/subscriber communication by Softing Germany. A security vulnerability exists in Softing uaToolkit Embedded prior to version 1.41, which stems from an incorrectly formatted...

PT-2023-15153 · Small Crm · Small Crm

Name of the Vulnerable Software and Affected Versions: Small CRM version 3.0 Description: A cross-site scripting XSS issue in the Create Ticket page allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter. This enables attackers to...

CVE-2022-47073

A cross-site scripting XSS vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter...

CVE-2022-25908

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25908

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

ALPINE-CVE-2022-47024

A null pointer dereference issue was discovered in function guix11createblankmouse in guix11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts...