Microweber 2.0.15 Cross Site Scripting

Exploit Title: Stored XSS in Microweber Date: 06/18/2024 Exploit Author: tmrswrr Vendor Homepage: https://microweber.me/ Version: 2.0.15 Tested on: http://active.demo.microweber.me/ Vulnerability Description A Stored Cross-Site Scripting XSS vulnerability has been identified in Microweber version...

Online Book Store SQL Injection Vulnerability

Online Book Store is an online bookstore by Arvin Arandilla, a personal developer. A SQL injection vulnerability exists in itsourcecode Online Book Store version 1.0, which stems from editbook.php containing an unknown function that causes SQL injection via the parameter image...

PT-2024-37311 · Unknown · Itsourcecode Online Bookstore

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Book Store versions up to 1.0 Description: A critical issue was found in the itsourcecode Online Book Store, where an unknown function of the file /edit book.php is affected. The manipulation of the image argument leads to...

CVE-2024-37369

A privilege escalation vulnerability exists in the affected product. The vulnerability allows low-privilege users to edit scripts, bypassing Access Control Lists, and potentially gaining further access within the system...

Rockwell Automation FactoryTalk View SE 安全漏洞

Rockwell Automation FactoryTalk View SE is an industrial automation system view interface from Rockwell Automation. An elevation of privilege vulnerability exists in Rockwell Automation FactoryTalk View SE, which can be exploited by an attacker to edit scripts that bypass access control lists and...

CVE-2024-36177 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page...

PT-2024-25170 · Gunet · Gunet Openeclass E-Learning Platform

Name of the Vulnerable Software and Affected Versions: GUnet OpenEclass E-learning Platform versions 3.15 and before Description: The issue is a cross-site scripting XSS vulnerability that allows an authenticated privileged attacker to execute arbitrary code. This can be achieved via the title an...

CVE-2024-5481 Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.8.23 via the escdir function. This makes it possible for authenticated attackers to cut and paste copy the contents of arbitrary files on the...

PT-2024-34448 · WordPress · The Minimal Coming Soon – Coming Soon Page

Name of the Vulnerable Software and Affected Versions: The Minimal Coming Soon – Coming Soon Page plugin for WordPress versions up to, and including, 2.38 Description: The issue is related to unauthorized modification of data due to a missing capability check on the validate ajax, deactivate ajax...

CVE-2023-37539

The Domino Catalog template is susceptible to a Stored Cross-Site Scripting XSS vulnerability. An attacker with the ability to edit documents in the catalog application/database created from this template can embed a cross site scripting attack. The attack would be activated by an end user clicki...

CVE-2024-36775

A cross-site scripting XSS vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page...

CVE-2024-36775

Monstra CMS 3.0.4 is affected by an XSS vulnerability in the Edit Profile page, where crafted payloads placed into the About Me field can execute arbitrary web scripts/HTML. The issue stems from reflecting or injecting content via the About Me parameter, enabling potential code execution in the c...

CVE-2024-36779

Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php...

Monstra CMS Security Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS by Sergey Romanenko, an individual developer in Ukraine. A security vulnerability exists in Monstra CMS version v3.0.4. An attacker can exploit the vulnerability to execute arbitrary web script or HTML via a specially crafted...

Sourcecodester Stock Management System Security Vulnerability

Sourcecodester Stock Management System is an inventory management system. A security vulnerability exists in Stock Management System v1.0. An attacker can exploit this vulnerability to conduct an SQL injection attack via editCategories.php...

PT-2024-27158 · Unknown · Monstra Cms

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page. This could potentially affe...

GO-2024-2761 Rancher Login Parameter Can Be Edited in github.com/rancher/rancher

Rancher Login Parameter Can Be Edited in github.com/rancher/rancher...

Cross-Site Scripting (XSS) in TYPO3 Backend

Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability...

CVE-2024-36569

Sourcecodester Gas Agency Management System v1.0 is vulnerable to arbitrary code execution via editClientImage.php...

PT-2024-27071 · Sourcecodester · Sourcecodester Garage Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Gas Agency Management System version 1.0 Description: The issue allows for arbitrary code execution via the editClientImage.php file. This could potentially lead to unauthorized access and control of the system. Recommendations...