CVE-2020-24621

A remote code execution RCE vulnerability was discovered in the htmlformentry aka HTML Form Entry module before 3.11.0 for OpenMRS. By leveraging path traversal, a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed...

GHSA-Q6J3-C4WC-63VW CSRF tokens leaked in URL by canned query form

Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitti...

CSRF tokens leaked in URL by canned query form

Impact The HTML form for a read-only canned query includes the hidden CSRF token field added in 798 for writable canned queries 698. This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhoodsearch submitti...

PT-2020-21453

Name of the Vulnerable Software and Affected Versions Datasette versions prior to 0.46 Description The HTML form for a read-only canned query in Datasette includes a hidden CSRF token field. When this form is submitted, the CSRF token is exposed in the URL. For example, submitting the form on...

CVE-2019-19987

CVE-2019-19987 affects Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29.0. The vulnerability is a Cross-Site Request Forgery (CSRF) in the web application’s handling of HTML forms, allowing an attacker to abuse functions such as change password, add user, and add privilege. Root c...

PT-2020-10306

Name of the Vulnerable Software and Affected Versions Selesta Visual Access Manager VAM versions 4.15.0 through 4.29 Description The issue allows Cross-Site Request Forgery CSRF on any HTML form, enabling an attacker to abuse functionalities such as changing passwords, adding users, adding...

Pricing Table by Supsystic < 1.8.1 - Cross-Site Request Forgery to XSS and Setting Changes

CSRF can be exploited against any of the functionalities in the Pricing Table by Supsystic WordPress plugin in vulnerable versions. One example:...

Online Book Store 1.0 - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: Online Book Store 1.0 - Arbitrary File Upload Exploit Author: Or4nG.M4n aka S4udiExploit Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/ Software Link:...

Stripo Inc: CSRF - Modify Project Settings

Target Url/Endpoint https://my.stripo.email/cabinet/stripeapi/v1/projects/ProjectId Note Attacker just need to know victim project Id. Summary: This CSRF Vulnerability leads to change user's project settings including General Information, Contacts, Social Networks and Other Options. Steps To...

Exploit for Cross-Site Request Forgery (CSRF) in Oneidentity Cloud_Access_Manager

CVE-2019-13497 Exploit Title: Cross Site Request Forgery CSR...

V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery

Exploit Title: V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery Author: LiquidWorm Discovery Date: 2019-09-26 Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd. Product web page: https://www.vsolcn.com Tested on: GoAhead-Webs Advisory ID: ZSL-2019-5536 Advisory URL:...

CVE-2019-5590

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

Cross site scripting

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

CVE-2019-5590: Improper Neutralization of Input During Web Page Generation

The URL part of the report message is not encoded in Fortinet FortiWeb 6.0.2 and below which may allow an attacker to execute unauthorized code or commands Cross Site Scripting via attack reports generated in HTML form...

CVE-2019-6968

The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected...

Design/Logic Flaw

The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected...

CVE-2019-6968

The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected...

CVE-2019-6968

CVE-2019-6968 affects the D-Link DVA-5592 (firmware 20180823); the web interface is vulnerable to XSS via directly reflected HTML form parameters. Red Hat entries concur the same D-Link XSS issue. The connected documents do not provide exploit details or remediation; no fix/version is specified i...

PT-2019-18387

Name of the Vulnerable Software and Affected Versions D-Link DVA-5592 version 20180823 Description The web interface is susceptible to a cross-site scripting XSS issue due to the direct reflection of HTML form parameters. Recommendations For D-Link DVA-5592 version 20180823, consider disabling th...

CVE-2019-6968: Improper Neutralization of Input During Web Page Generation

The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected...