53 matches found
CVE-2025-4576
CVE-2025-4576 describes a reflected XSS in Liferay Portal 7.4.0–7.4.3.133 and Liferay DXP versions listed (various 2024/Qx and 2025/Q1 ranges, up to 7.4 GA with update 92). The vulnerability allows a remote, non-authenticated attacker to inject JavaScript into the page at modules/apps/blogs/blogs...
CVE-2024-10744
A vulnerability was found in PHPGurukul Online Shopping Portal 2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/assets/plugins/DataTables/media/unittesting/templates/complexheader2.php. The manipulation of the argument scripts...
WordPress Graphicsly plugin <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload vulnerability
Authenticated Author+ Stored Cross-Site Scripting via SVG File Upload vulnerability discovered by Francesco Carlucci in WordPress Plugin Graphicsly versions = 1.0.2...
CVE-2024-42624
FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/page/delete/10...
CVE-2021-4046
The mtxtNom y mtxtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking or theft of sensitive data...
yellownepal.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1065107 Security Researcher geeknik Helped patch 8924 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting yellownepal.com website an...
CVE-2019-0335
Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console, versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the...
Microsoft Edge Chakra JIT - BailOutOnInvalidatedArrayHeadSegment Check Bypass Exploit
Exploit for windows platform in category dos / poc / The BailOutOnInvalidatedArrayHeadSegment check uses the JavascriptArray::GetArrayForArrayOrObjectWithArray method to check whether the given object is an array. If it's not an array, it will decide to skip the check which means that no bailout...
finnertyandstevens.com XSS vulnerability
Open Bug Bounty ID: OBB-658565 Description| Value ---|--- Affected Website:| finnertyandstevens.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Remote Code Execution (RCE)
microsoft.chakracore is vulnerable to remote code execution RCE attacks. The vulnerability exists in CrossSite::CommonThunk of lib/Runtime/Base/CrossSite.cpp where the Chakra scripting engine handles objects in memory insecurely, causing a Chakra Scripting Engine Memory Corruption vulnerability...
Microsoft Edge: Chakra: Cross context bug(CVE-2018-0946)
Background The CrossSite class is used for passing JavaScript variables across different contexts. Chakra is basically trying to wrap every variable being passed from a context to another context. The way it wraps an object is, first overwrite the virtual function table pointer of the given objec...
Microsoft Edge Chakra - Cross Context Use-After-Free
Microsoft Edge Chakra - Cross Context Use-After-Free f.onload = null; // Garbage collection for let i = 0; i 10; i++ new ArrayBuffer1024 1024 40; let obj = opt; // "opt" returns the freed string constant. ; // Closing the diffrent context f.src = 'about:blank'; But in fact, if you run the code, y...
WordPress Keyword Link Plugin <= 1.7 - CrossSite Scripting (XSS)
Because of this vulnerability, authenticated administrators can store HTML or JS code via "limit" parameter. Solution Update the plugin...
WordPress Ptengine Plugin <= 2.2.2 - 1.0.1 - Reflected CrossSite Scripting
Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...
CVE-2015-2089
Multiple cross-site request forgery CSRF vulnerabilities in the CrossSlide jQuery crossslide-jquery-plugin-for-wordpress plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings or conduct cross-site scripting XSS...
Media Player Classic security vulnerabilities
Built-in web server DoS and crossite scripting...
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...
Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc...