11996 matches found
iGalerie Security Breach
iGalerie is an online gallery application. A security vulnerability exists in iGalerie version v3.0.22, which stems from a reflected cross-site scripting vulnerability in the Titre field of the edit screen...
PT-2024-19511 · Unknown · Webcalendar
Name of the Vulnerable Software and Affected Versions: WebCalendar version 1.3.0 Description: A reflected cross-site scripting XSS issue was discovered in the /WebCalendarvqsmnseug2/edit entry.php component. This issue allows for the execution of malicious scripts on the client-side...
Octopus SQL Injection Vulnerability
Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. An SQL injection vulnerability exists in Octopus version 1.0, which stems from the parameter ancestors in the file /system/dept/edit that can lead to SQL injection...
PT-2024-15895 · Unknown · Hongmaple Octopus
Name of the Vulnerable Software and Affected Versions: hongmaple octopus version 1.0 Description: A critical issue has been found in the software, affecting an unknown function of the file /system/dept/edit. The manipulation of the ancestors argument leads to SQL injection. This issue can be...
CVE-2024-22638
liveSite v2019.1 was discovered to contain a remote code execution RCE vulenrabiity via the component /livesite/editdesignerregion.php or /livesite/addemailcampaign.php...
PT-2024-19514 · Livesite · Livesite
Name of the Vulnerable Software and Affected Versions: liveSite version 2019.1 Description: The issue is related to a remote code execution RCE via the components "/livesite/edit designer region.php" or "/livesite/add email campaign.php". Recommendations: For liveSite version 2019.1, at the momen...
CVE-2023-49783 No permission checks for editing/deleting records with CSV import form
Silverstripe Admin provides a basic management interface for the Silverstripe Framework. In versions on the 1.x branch prior to 1.13.19 and on the 2.x branch prior to 2.1.8, users who don't have edit or delete permissions for records exposed in a ModelAdmin can still edit or delete records using...
SilverStripe Admin Security Vulnerability
SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . A security vulnerability exists in Silverstripe Admin version 1.x prior to 1.13.19 and...
liuwy-dlsdys zhglxt Cross-Site Scripting Vulnerability
zhglxt is a web application by the Chinese liuwy-dlsdys individual developer. A cross-site scripting vulnerability exists in liuwy-dlsdys zhglxt version 4.7.7, which stems from the parameter notifyTitle in the file /oa/notify/edit that causes cross-site scripting...
CVE-2024-22414
flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the /user/ page allows a user's comments to execute arbitrary javascript code. The html template user.html contains the following code snippet to render comments made by a user: comment2|safe. Use of the "safe" tag...
Design/Logic Flaw
flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the /user/ page allows a user's comments to execute arbitrary javascript code. The html template user.html contains the following code snippet to render comments made by a user: comment2|safe. Use of the "safe" tag...
CVE-2024-22414 User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlog
flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the /user/ page allows a user's comments to execute arbitrary javascript code. The html template user.html contains the following code snippet to render comments made by a user: comment2|safe. Use of the "safe" tag...
CVE-2024-22715
Stupid Simple CMS =1.2.4 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin-edit.php...
Cross site request forgery (csrf)
Stupid Simple CMS =1.2.4 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin-edit.php...
Stupid Simple CMS Security Vulnerability
Stupid Simple CMS is a content management system by codelyfe individual developer. A security vulnerability exists in Stupid Simple CMS version 1.2.4, which contains a cross-site request forgery CSRF vulnerability via the component /admin-edit.php...
PT-2024-19535 · Unknown · Stupid Simple Cms
Name of the Vulnerable Software and Affected Versions: Stupid Simple CMS versions =1.2.4 Description: A Cross-Site Request Forgery CSRF issue was discovered in the /admin-edit.php component. This allows for potential unauthorized actions on the affected system. Recommendations: For versions =1.2....
The vulnerability of the /ample/app/action/edit_product.php file of the Free and Open Source Inventory Management System allows a perpetrator to execute arbitrary SQL queries.
The vulnerability of the /ample/app/action/editproduct.php file of the Free and Open Source Inventory Management System is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
CVE-2024-22625
Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /SupplyManagementSystem/admin/editcategory.php?id=...