11685 matches found
CVE-2021-41965
A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized ENtyid, theID and EID fields used when an Edit action on an existing record is being performed...
CVE-2021-41965
A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized ENtyid, theID and EID fields used when an Edit action on an existing record is being performed...
GHSA-3857-XM38-JMQ2 Incorrect Authorization in Jenkins Core
Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service unable to login by editing the "full name."...
Incorrect Authorization in Jenkins Core
Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service unable to login by editing the "full name."...
Fork CMS XSS Vulnerability
Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter...
Cross-site Scripting (XSS)
Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the managefiltereditpage.php process. An attacker can execute arbitrary code when displaying a filter with a crafted name. Details Cross-site scripting or XSS is a...
GHSA-74GH-5J33-VG4W MantisBT allows XSS on the Edit Filter page via crafted filter name
An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...
MantisBT allows XSS on the Edit Filter page via crafted filter name
An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...
GHSA-9M82-F3WX-P625 LibreNMS XSS Vulnerability
Persistent Cross-Site Scripting XSS issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboardname parameter in the /ajaxform.php resource, related to html/includes/forms/add-dashboard.inc.php, html/includes/forms/delete-dashboard.inc.php, and...
GHSA-GCQW-45XQ-XC63 MantisBT allows XSS via Edit Filter page
A cross-site scripting XSS vulnerability in the Edit Filter page managefilteredit page.php in MantisBT 2.1.0 through 2.17.1 allows remote attackers if access rights permit it to inject arbitrary code if CSP settings permit it through a crafted project name...
MantisBT allows XSS via Edit Filter page
A cross-site scripting XSS vulnerability in the Edit Filter page managefilteredit page.php in MantisBT 2.1.0 through 2.17.1 allows remote attackers if access rights permit it to inject arbitrary code if CSP settings permit it through a crafted project name...
GHSA-FX2M-5M9V-JHGP XSS in baserCMS before 4.1.4
An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the dataUploaderCategoryname parameter to an admin/uploader/uploadercategories/edit URI...
MODX Revolution allows XSS via document resources
MODX Revolution through v2.7.0-pl allows XSS via a document resource such as pagetitle, which is mishandled during an Update action, a Quick Edit action, or the viewing of manager logs...
GHSA-MPMX-GM5V-Q789 Puppet uses predictable filenames, allowing arbitrary file overwrite
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files...
Showdoc Unauthenticated Access
ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...
GHSA-PFRC-5HHQ-6HVR Showdoc Unauthenticated Access
ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...
GeniXCMS Mailbox validation logic vulnerability
GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSGUSEREMAILEXIST protection mechanism via a register.php?act=edit&id=1 request...
GHSA-559C-W54X-8342 GeniXCMS Mailbox validation logic vulnerability
GeniXCMS 1.0.2 allows remote attackers to bypass the alertDanger MSGUSEREMAILEXIST protection mechanism via a register.php?act=edit&id=1 request...