12220 matches found
PT-2023-6692 · Bitrix +1 · Bitrix24 +1
Name of the Vulnerable Software and Affected Versions: Bitrix24 version 22.0.300 Description: A cross-site scripting XSS issue in the Invoice Edit Page of Bitrix24 allows attackers to execute arbitrary JavaScript code in the victim's browser. If the victim has administrator privileges, it is also...
Bitrix24 Cross-Site Scripting Vulnerability
Bitrix24 is a suite of enterprise social platforms from Bitrix USA. The platform includes features such as online communication, calendar management, and CRM Customer Relationship Management. A security vulnerability exists in Bitrix24 version 22.0.300, which stems from a cross-site scripting XSS...
Paragraphs admin - Moderately critical - - SA-CONTRIB-2023-049
This module enables you to view all paragraph entities in an admin view. The module contains an access bypass that allows non admin users to access the view. The vulnerability can be mitigated by editing the view to change the permission required to access the page...
CVE-2023-47095
A Stored Cross-Site Scripting XSS vulnerability in the Custom fields of Edit Virtual Server under System Customization in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Batch Label field while details of Virtual Server...
PT-2023-6864 · Netgate · Pfsense
Name of the Vulnerable Software and Affected Versions: Netgate pfSense version 2.7.0 Description: An issue in Netgate pfSense allows a remote attacker to execute arbitrary code via a crafted request to the interfaces gif edit.php and interfaces gre edit.php components. This is due to the lack of...
CVE-2023-47095
A Stored Cross-Site Scripting XSS vulnerability in the Custom fields of Edit Virtual Server under System Customization in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Batch Label field while details of Virtual Server...
CVE-2023-46854
Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature...
CVE-2023-46854
Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature...
CVE-2023-46854
Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature...
Design/Logic Flaw
Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature...
proxmox-widget-toolkit Cross-Site Scripting Vulnerability
proxmox-widget-toolkit is an open source toolkit for proxmox. A cross-site scripting vulnerability exists in Proxmox proxmox-widget-toolkit versions prior to 4.0.9, which stems from allowing cross-site scripting attacks via the Edit Comments feature...
CVE-2023-5827
A vulnerability was found in Shanghai CTI Navigation CTI Monitoring and Early Warning System 2.2. It has been classified as critical. This affects an unknown part of the file /Web/SysManage/UserEdit.aspx. The manipulation of the argument ID leads to sql injection. The exploit has been disclosed t...
CVE-2023-46818
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if adminallowlangedit is enabled...
PT-2023-32359 · Shanghai Cti Navigation · Cti Monitoring/Early Warning System
Name of the Vulnerable Software and Affected Versions: Shanghai CTI Navigation CTI Monitoring and Early Warning System version 2.2 Description: A critical issue was found in the system, affecting the /Web/SysManage/UserEdit.aspx file. The manipulation of the ID argument leads to sql injection. Th...
PT-2023-32344 · Unknown · Flusity-Cms
Name of the Vulnerable Software and Affected Versions: flusity CMS affected versions not specified Description: A problematic issue has been found in flusity CMS, affecting the loadPostAddForm function of the file core/tools/posts.php. The manipulation of the edit post id argument leads to...
PT-2024-24096 · Xwiki · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 5.0-rc-1 through 14.10.19 XWiki Platform versions 15.5.3 and earlier XWiki Platform versions prior to 15.9-rc-1 Description: The issue allows any user with edit rights on any page to execute code on the server by addin...
CVE-2023-45135 XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In org.xwiki.platform:xwiki-platform-web versions 7.2-milestone-2 until 14.10.12 and org.xwiki.platform:xwiki-platform-web-templates prior to versions 14.10.12 and 15.5-rc-1, it is possible to...
CVE-2023-37909 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros th...
ISPConfig language_edit.php PHP Code Injection
This module exploits a PHP code injection vulnerability in ISPConfig's languageedit.php file. The vulnerability occurs when the adminallowlangedit setting is enabled, allowing authenticated administrators to inject arbitrary PHP code through the language editor interface. This module will...