CVE-2018-20370

SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend...

CVE-2018-20370

SZ NetChat before 7.9 is vulnerable to Cross-Site Scripting in the Options module (MyName input). The root cause is an XSS flaw in the MyName field, allowing a remote attacker to inject inputs that could compromise the enabled HTTP server web frontend. The public references consistently describe ...

CVE-2018-20370: Improper Neutralization of Input During Web Page Generation

SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend...

What happens when packages go bad?

I built spritecow.com back in 2011, and I no longer actively maintain it. A few months ago, a user berated me for using a crypto currency miner on the site without their informed consent. And sure enough, the site's JS had a small addition that loaded the mining JS, and sent the result somewhere...

Code Execution Vulnerability in Frontend of zzzcms V1.5.8 Official Version

zzcms is a free and open source building system, mainly facing the majority of webmasters use. zzzcms V1.5.8 official version of the foreground there is a code execution vulnerability, an attacker can use the vulnerability to obtain control of the web server...

Code Execution Vulnerability in FeiFeiCms Frontend

FeiFeiCms is developed with PHP+Mysql technology and can run on windows and Linux system platform. FeiFeiCms code execution vulnerability exists in the front-end, an attacker can exploit the vulnerability to obtain control of the web server...

CVE-2018-2502

CVE-2018-2502 affects SAP Business One Service Layer (B1_ON_HANA) with TRACE method enabled, enabling potential Cross Site Tracing (XST) when frontend applications expose an XSS vulnerability. The connected documents specify the vulnerable component as SAP Business One Service Layer and reference...

Denial of Service in Frontend Record Registration

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...

Cross-Site Scripting in Frontend User Login

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-008...

Denial of Service in Frontend Record Registration

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-012...

Cross-Site Scripting in Frontend User Login

More info at https://typo3.org/security/advisory/typo3-core-sa-2018-008...

zzzcms v1.5.8 SQL Injection Vulnerability in Frontend in***.php File

zzcms is a free website builder developed in asp language. zzzcms v1.5.8 SQL injection vulnerability exists in the foreground in.php file. An attacker can exploit the vulnerability to obtain sensitive information from the database...

S-CMS Enterprise Website Builder System SQL Injection Vulnerability in Frontend co***/fo***.php Page

S-CMS enterprise station building system is Zibo Shining Network Technology Co., Ltd. developed a specialized enterprise station building solutions for the product. There is a SQL injection vulnerability in the front co/fo.php page of S-CMS enterprise website builder system. Attackers can use the...

Command Execution Vulnerability in the Frontend of DSCms Enterprise Content Management System

DScms is using PHP + Mysql architecture, it is a cms building system for enterprise website construction. A command execution vulnerability exists in the frontend of the DSCms enterprise site content management system. An attacker can exploit the vulnerability to gain server privileges...

Cross-Site Scripting in Frontend User Login

Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability - either a backend user or a frontend user having the possibility to modify their user profile...

typo3 -- multiple vulnerabilities

Typo3 core team reports: CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...

Code Execution Vulnerability in anmi V1.1.0 Frontend

Anmi program is a program that focuses on H5 mobile website/app construction. Code execution vulnerability exists in anmi V1.1.0 frontend. An attacker can exploit the vulnerability to execute commands and gain server privileges...

File Inclusion Vulnerability in ThinkCMF 2.2.3 Frontend Plu*** File

ThinkCMF is a Chinese content management framework based on PHP+MYSQL. A file inclusion vulnerability exists in the ThinkCMF 2.2.3 front-end Plu page. An attacker can exploit this vulnerability to write a webshell and obtain web privileges...

SQL injection vulnerability in ESPCMS P8 frontend Me***.php file

ESPCMS is an enterprise website management system built on LAMP development. A SQL injection vulnerability exists in the ESPCMS P8 frontend Me.php file. An attacker can use this vulnerability to obtain sensitive information from the database...

Dandelion Online Teaching System frontend ex*** routing file has SQL injection vulnerability

Dandelion Online Teaching System is the website of Shenzhen Tomorrow See Technology Co., Ltd, which is an innovative science and technology enterprise focusing on the research and development of videoconferencing, video teaching and telemedicine system. Dandelion Online Teaching System has a SQL...