Chamilo 安全漏洞

Chamilo is an open-source learning management system developed by Chamilo. Versions of Chamilo prior to 1.11.30 contained security vulnerabilities. These vulnerabilities stemmed from improper handling of the open parameter in the help.php file, which could allow attackers to inject arbitrary HTML...

VulnCheck KEV: CVE-2002-1131

Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via 1 addressbook.php, 2 options.php, 3 search.php, or 4 help.php...

CVE-2023-0746

The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforce a user into inserting malicious JavaScript code into the URI, that could lead to a Reflected Cross site Scripting...

PT-2023-16498

Name of the Vulnerable Software and Affected Versions GigaVUE-FM version 5.0 202 Description The help page in GigaVUE-FM does not require an authenticated user, allowing an attacker to enforce a user into inserting malicious JavaScript code into the URI. This could lead to a Reflected Cross site...

CVE-2023-0746: Improper Neutralization of Input During Web Page Generation

The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforce a user into inserting malicious JavaScript code into the URI, that could lead to a Reflected Cross site Scripting...

SUSE CVE-2015-1159

Cross-site scripting XSS vulnerability in the cgiputs function in cgi-bin/template.c in the template engine in CUPS before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via the QUERY parameter to help/...

CVE-2022-36121: Undefined Security Weakness

An issue was discovered in Blue Prism Enterprise 6.0 through 7.01. In a misconfigured environment that exposes the Blue Prism Application server, it is possible for an authenticated user to reverse engineer the Blue Prism software and circumvent access controls for the UpdateOfflineHelpData...

CVE-2022-23165

Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting XSS - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected produc...

Sysaid Technologies Sysaid 跨站脚本漏洞

Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. Sysaid Technologies Sysaid version 14.2.0 suffers from a cross-site scripting vulnerability that originates from a lack of filtering and escaping of the parameter helpPageName used by the pa...

CVE-2022-23165

Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting XSS - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected produc...

CVE-2021-38466

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the help page. This may allow an attacker to perform a reflected cross-site scripting attack, which could allow an attacker to run code on behalf of the client...

PT-2021-22140

Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description The issue concerns insufficient input validation on client requests from the help page, potentially allowing an attacker to perform a reflected cross-site...

CVE-2021-38466: Improper Neutralization of Input During Web Page Generation

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the help page. This may allow an attacker to perform a reflected cross-site scripting attack, which could allow an attacker to run code on behalf of the client...

CVE-2021-38466

InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not perform sufficient input validation on client requests from the help page. This may allow an attacker to perform a reflected cross-site scripting attack, which could allow an attacker to run code on behalf of the client...

Wing FTP 跨站脚本漏洞

Wing FTP Server is a cross-platform FTP server software. A cross-site scripting vulnerability exists in Wing FTP version 6.4.4, where an arbitrary IFRAME element can be included in a help page via a specially crafted link, which can be exploited by an attacker to execute sandbox arbitrary HTML an...

CVE-2019-18793

Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the "fileName" parameter...

Shopify: help.shopify.com Cross Site Scripting

Hello Security Team. Tested windows 10 and edge Microsoft Edge 44.17763.1.0 , internet explorer Test Url : https://help.shopify.com/it/partners/resources/marketing-pack-for-accountants Payload: ?v0sjx'-alert1-'uyvvr=1 Proof Url: Open Url: edge , internet explorer , click me "Condividi il tuo...

PT-2018-9466

Name of the Vulnerable Software and Affected Versions SURFnet OpenConext EngineBlock versions 5.7.0 through 5.7.3 Description The issue allows an attacker to inject arbitrary web scripts or HTML into help and login pages via a specially crafted URL, potentially leading to a Cross Site Scripting X...

CVE-2017-14524

Multiple open redirect vulnerabilities in OpenText Documentum Administrator 7.2.0180.0055 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a 1 URL in the startat parameter to xda/help/en/default.htm or 2 /%09/ slash encoded horizontal tab slash...

Cross-site scripting vulnerability in S-CMS /admin/help.asp page

S-CMS is a corporate website building system developed by Zibo Shining Network Technology Co. A cross-site scripting vulnerability exists in the /admin/help.asp page in S-CMS v3.0 build20170911. Allows an attacker to construct XSS statements and perform pop-up box operations to obtain sensitive...