6527 matches found
MindPalette NateMail 3.0.15 - Cross-Site Scripting
MindPalette NateMail 3.0.15 is susceptible to reflected cross-site scripting which could allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note...
Timesheet Next Gen <=1.5.3 - Cross-Site Scripting
Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the...
WordPress Checklist <1.1.9 - Cross-Site Scripting
WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file. id: CVE-2019-16525 info: name: WordPress Checklist 1.1.9 - Cross-Site Scripting author: daffainfo severity: medium description:...
Simple URLs < 115 - Cross Site Scripting
The plugin does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-0099 info: name: Simple URLs 115 - Cross Site Scripting author: r3Y3r53 severit...
ChurchCRM 4.5.3 - Cross-Site Scripting
A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...
Academy LMS 6.0 - Cross-Site Scripting
Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. id: CVE-2023-38964 info: name: Academy LMS 6.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Creative Item Academy LMS 6.0 was discovered to...
WooCommerce Payments - Unauthorized Admin Access
An issue in WooCommerce Payments plugin for WordPress versions 5.6.1 and lower allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the...
WordPress WooCommerce <1.13.22 - Cross-Site Scripting
WordPress WooCommerce before 1.13.22 contains a reflected cross-site scripting vulnerability via the slider import search feature because it does not properly sanitize the keyword GET parameter. id: CVE-2021-24300 info: name: WordPress WooCommerce 1.13.22 - Cross-Site Scripting author: cckuailong...
Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting
A PHP script in the source code release echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting XSS vulnerability exploitable through Cross-Site Request Forgery CSRF. id: CVE-2025-47204 info: name: Bootstr...
DedeCMS v5.7.111 - Cross-Site Scripting
DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting XSS vulnerability via the component selectmediapostwangEditor.php. id: CVE-2023-49494 info: name: DedeCMS v5.7.111 - Cross-Site Scripting author: ritikchaddha severity: medium description: | DedeCMS v5.7.111 was discover...
Aajoda Testimonials < 2.2.2 - Cross-Site Scripting
The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id: CVE-2023-2178 info: name: Aajoda Testimonials...
HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting
HotelDruid Hotel Management Software 3.0.3 contains a cross-site scripting vulnerability via the prezzoperiodo4 parameter in creaprezzi.php. id: CVE-2022-26564 info: name: HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting author: alexrydzak severity: medium description: | HotelDru...
WordPress-XStore-theme-SQL-Injection
WordPress-XStore-tema-SQL-Injection CVE-2024-33559 XStore tema-SQL Injection CVE-2024-33551 es una vulnerabilidad de inyección SQL encontrada en 8theme XStore, una plataforma de comercio electrónico construida sobre WordPress. Esta vulnerabilidad permite a los atacantes ejecutar comandos SQL...
FireStorePwn
FireStorePwn fsp Escáner de vulnerabilidades de bases de datos Firestore usando APKs fsp escanea un APK y comprueba si la base de datos Firestore tiene reglas que no son seguras, realizando pruebas con o sin autenticación. Si hay problemas con las reglas de seguridad, los atacantes podrían robar,...
PT-2026-86671
HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft...
CVE-2025-65482-XXE-
CVE-2025-65482 XXE XML External Entity Injection XXE en XDocReport Definición del error XML External Entity Injection Resumen de la vulnerabilidad XML External Entity Injection XXE es una vulnerabilidad en el procesamiento de datos en formato XML, donde el usuario inserta datos XML que hacen...
cve-2021-27065
I will continue to add any new code or modify existing code based on searching for stolen data If you have been compromised these scripts will by no means fix it for you! These provide no benifit to you other than you now knowing the extent of what has happened to your system With that being said...
CVE-2023-1454-EXP
CVE-2023-1454-EXP CVE-2023-1454 jeecg-boot Vulnerabilidad de inyección SQL no autorizada JeecgBoot es una plataforma de desarrollo de bajo código basada en generadores de código. La plataforma Java de bajo código jeecg-boot v3.5.0 para aplicaciones web empresariales presenta la última...
CVE-2026-22010-Android-Intent-Redirection-to-Exported-Component
CVE-2026-22010 – Redirección de Intent de Android a Componente Exportado Código del programa simulación Java/Android root@kitploit: // VulnActivity.java - Exported activity that forwards intents public class VulnActivity extends Activity @Override protected void onCreateBundle b super.onCreateb;...
