CVE-2021-30171

Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-30170

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-30172

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

CVE-2021-30170

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

Cross site scripting

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

Cross site scripting

Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-30171 Jun-He Technology Ltd. ERP POS - Stored XSS-2

Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-30171

CVE-2021-30171 affects Jun-He Technology / Junghwa ERP POS: special characters on the ERP POS news page are not filtered, allowing remote authenticated attackers to inject JavaScript and perform stored XSS, with potential access to and manipulation of customer information. Root cause: unfiltered ...

CVE-2021-30172

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

CVE-2021-30170

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-30171

Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

竣禾科技 ERP POS 跨站脚本漏洞

Junghwa Technology ERP POS System is an application software of China Junghwa Technology Co. system used for ERP management. ERP POS suffers from a cross-site scripting vulnerability that originates from special characters on the customer profile page not being filtered during user input, which...

竣禾科技 ERP POS 跨站脚本漏洞

Junghwa Technology ERP POS System is an application software of China Junghwa Technology Co. System for ERP management. ERP POS suffers from a cross-site scripting vulnerability that originates from special characters on the news page not being filtered during user input, which allows remote...

CVE-2021-30170: Improper Neutralization of Input During Web Page Generation

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

Apache Unomi Injection Vulnerability

Apache Unomi is the United States Apache Software Apache Foundation's set of open source customer data platform. The platform is mainly written in Java language. An injection vulnerability exists in Apache Unomi versions prior to 1.5.5. The vulnerability stems from the failure of a networked syst...

The vulnerability of the Customer Tab sub-component of the Oracle Customers Online component of the Oracle E-Business Suite allows a malicious actor to gain unauthorized access to the device and disclose protected information.

The vulnerability of the Customer Tab sub-component of the Oracle Customers Online component of the Oracle E-Business Suite is related to code errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to the device and disclose protected...

WordPress WP Customer Reviews plugin <= 3.5.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Truoc Phan in WordPress WP Customer Reviews plugin versions = 3.5.5. Solution Update the WordPress WP Customer Reviews plugin to the latest available version at least 3.5.6...

Rukovoditel Cross-Site Request Forgery Vulnerability

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . Rukovoditel v2.8.3 version of the cross-site request forgery vulnerability , the vulnerability stems fr...

SuiteCRM 跨站脚本漏洞

SuiteCRM is a free open source customer relationship management application. A cross-site scripting vulnerability exists in the customer account page of SuiteCRM versions prior to 7.11.19. An attacker can exploit the vulnerability to inject JavaScript via the name field...

Directory traversal

Sonatype Nexus Repository Manager 3.x before 3.30.1 allows a remote attacker to get a list of files and directories that exist in a UI-related folder via directory traversal no customer-specific data is exposed...