1513 matches found
CVE-2020-14024
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the 1 Receiver or Recipient field in the Mailbox feature, 2 OZFORMGROUPNAME field in the Group configuration of addresses, 3 listname field in the Defining address lists configuration, o...
CVE-2020-14024
CVE-2020-14024 специалисты описывают как у Ozeki NG SMS Gateway до версии 4.17.6 обнаружены несколько XSS-уязвимостей, требующих аутентифицированного доступа: через поля Receiver/Recipient в Mailbox, OZFORM_GROUPNAME в настройках групп адресов, поле listname в Defining Address Lists и через любой...
CVE-2020-14024: Improper Neutralization of Input During Web Page Generation
Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the 1 Receiver or Recipient field in the Mailbox feature, 2 OZFORMGROUPNAME field in the Group configuration of addresses, 3 listname field in the Defining address lists configuration, o...
CVE-2020-25378
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting XSS via the id GET parameter...
CVE-2020-25378: Improper Neutralization of Input During Web Page Generation
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting XSS via the id GET parameter...
Unintended Require in larvitbase-www
All versions of larvitbase-www are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an require call. This allows attackers to execute any .js file in the same folder as the server is running. Recommendation No fix is currently...
GHSA-88H9-FC6V-JCW7 Unintended Require in larvitbase-www
All versions of larvitbase-www are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an require call. This allows attackers to execute any .js file in the same folder as the server is running. Recommendation No fix is currently...
GHSA-CR67-78JR-J94P Local File Inclusion in domokeeper
All versions of domokeeper are vulnerable to Local File Inclusion. The /plugin/ route passes a GET parameter unsanitized to a require call. It then returns the output of require in the server response. This may allow attackers to load unintended code in the application. It also allows attackers t...
Local File Inclusion in domokeeper
All versions of domokeeper are vulnerable to Local File Inclusion. The /plugin/ route passes a GET parameter unsanitized to a require call. It then returns the output of require in the server response. This may allow attackers to load unintended code in the application. It also allows attackers t...
Mail.ru: the same as #948259 - XSS at jsgames.mail.ru
Reflected XSS in jsgames.mail.ru via GET parameter backurl found it in under 1 minute , thanks for sharing @yukusawa18 ;...
CVE-2020-24602
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and...
CVE-2020-24602
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and...
CVE-2020-24602
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and...
CVE-2020-24602
Openfire 4.5.1 is affected by a reflected XSS in the Server Properties and Security Audit Viewer JSP page. The vulnerability allows an attacker to trigger arbitrary URL execution by manipulating the vulnerable GET parameters: searchName, searchValue, searchDescription, searchDefaultValue, searchP...
CVE-2020-24602: Improper Neutralization of Input During Web Page Generation
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameter searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescription" and...
CVE-2020-24316: Improper Neutralization of Input During Web Page Generation
WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...
CVE-2020-24313: Improper Neutralization of Input During Web Page Generation
Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the "AppointmentID" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially...
DBHcms Arbitrary File Read Vulnerability
DBHcms is a small, free and open source content management system for personal and small business websites. An arbitrary file read vulnerability exists in dbhcmsmodmod.editor.php $GET'file' in DBHcms 1.2.0. Attackers can use the vulnerability to read the contents of any file...
DBHcms Cross-Site Scripting Vulnerability (CNVD-2020-49084)
DBHcms is a small, free and open source content management system for personal and small business websites. DBHcms 1.2.0 suffers from a stored cross-site scripting vulnerability. The vulnerability stems from the absence of a security filter for the $GET'dbhcmspid' variable in dbhcmspage.php on li...