WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Arbitrary File Upload

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A2: Broken Authentication Classification Arbitrary File Upload CVE CVE-2022-46839 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 21f585ae6afa Credi...

CVE-2022-46968: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in /index.php?page=help of Revenue Collection System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into sent messages...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Settings Change

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A2: Broken Authentication Classification Settings Change CVE CVE-2022-46838 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID f5722521e19a Credits...

JS Help Desk < 2.7.2 - CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to SQL Injection

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47151 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 3458eadeff2d Credits RE-ALTER Require...

WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software JS Help Desk – Best Help Desk & Support Plugin Type Plugin Vulnerable versions = 2.7.1 Fixed in 2.7.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-46842 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID...

Revenue Collection System 跨站脚本漏洞

Revenue Collection System is a landed property billing and payment software by Carlo Montero Individual Developer. A security vulnerability exists in Revenue Collection System v1.0, which stems from its /index.php?page=help component that allows an attacker to execute arbitrary web script or HTML...

PT-2023-15123

Name of the Vulnerable Software and Affected Versions Revenue Collection System version 1.0 Description A stored cross-site scripting issue exists, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into sent messages, specifically in the /index.php?page=he...

UBUNTU-CVE-2022-41941

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...

GLPI 跨站脚本漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

CVE-2022-41941 glpi contains XSS Stored inside Standard Interface Help Link href attribute

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...

CVE-2022-41941 glpi contains XSS Stored inside Standard Interface Help Link href attribute

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...

PT-2023-9268 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 10.0.0 through 10.0.5 Description: The issue is related to Cross-site Scripting, where an administrator can store malicious code in help links. This can be exploited by a remote attacker to save arbitrary code in the help links...

CVE-2022-41941: Improper Neutralization of Input During Web Page Generation

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...

SolarWinds Web Help Desk <= 12.7.6 Arbitrary Code Execution

The version of SolarWinds Web Help Desk installed on the remote host is prior to or equal to 12.7.6. It is, therefore, affected by an arbitrary code execution vulnerability. Through hard coded credentials, an attacker with local access to the Web Help Desk host machine allows to execute arbitrary...

CVE-2022-37310

OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /!!&app=io.ox/files&cap= URI...

CVE-2022-37310

OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /!!&app=io.ox/files&cap= URI...

CVE-2022-37310

OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /!!&app=io.ox/files&cap= URI...

PT-2022-23918 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows for XSS via a malicious capability to the metrics or help module. This can be demonstrated by a URI such as "/!!&app=io.ox/files&cap=". Recommendations: For versions 7.10....

CVE-2022-37310

OX App Suite 7.10.6 and earlier is affected by a Cross‑Site Scripting (XSS) vulnerability introduced via a malicious capability to the metrics or help module, exploitable through a URI like /#!!&app=io.ox/files&cap=. Impact cited includes execution of script in the victim’s context and potential ...