5523 matches found
CVE-2024-35645: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in M A Vinoth Kumar Random Banner random-banner allows DOM-Based XSS.This issue affects Random Banner: from n/a through = 4.2.12...
CVE-2024-1100
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Vadi Corporate Information Systems DIGIKENT GIS allows SQL Injection. This issue affects DIGIKENT GIS: through 2.23.5...
CVE-2024-0851
CVE-2024-0851 affects Grup Arge Energy and Control Systems Smartpower (web-based Energy Management System). The vulnerability is an SQL Injection due to improper neutralization of special elements in SQL commands, affecting Smartpower up to and including V24.05.27. Documented impact indicates hig...
CVE-2024-4286 Improper Neutralization of Special Elements in mintplex-labs/anything-llm
Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in the commit id 57984fa85c31988b2eff429adfc654c46e0c342a. The vulnerability arises from the application's handling of user modifications by...
CVE-2024-4286 Improper Neutralization of Special Elements in mintplex-labs/anything-llm
Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in the commit id 57984fa85c31988b2eff429adfc654c46e0c342a. The vulnerability arises from the application's handling of user modifications by...
PT-2024-30186 · Mintplex · Anything-Llm
Name of the Vulnerable Software and Affected Versions: Mintplex-Labs' anything-llm application affected versions not specified Description: The application is vulnerable to improper neutralization of special elements used in an expression language statement. This vulnerability arises from the...
CVE-2024-3594: Improper Neutralization of Input During Web Page Generation
The IDonate WordPress plugin through 1.9.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-4267 Remote Code Execution in parisneo/lollms-webui
A remote code execution RCE vulnerability exists in the parisneo/lollms-webui, specifically within the 'openfile' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'openfile' function. An attacker can exploit this...
Command Injection
consoleme is vulnerable to Command Injection. The vulnerability is due to improper neutralization of special elements used in a command, potentially allowing an attacker to inject and execute arbitrary commands via an argument flag...
CVE-2024-4214
CVE-2024-4214 is a Basic XSS vulnerability in the WordPress Cardealer plugin (Car Dealer). The connected documents indicate an improper neutralization of script-related HTML tags in a Car Dealer web page, affecting the plugin versions up to 4.15. The sources do not provide concrete attack vectors...
CVE-2024-34567
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in GhozyLab, Inc. Popup Builder allows Stored XSS.This issue affects Popup Builder: from n/a through 1.1.29...
CVE-2024-34757
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Visualmodo Borderless borderless allows DOM-Based XSS.This issue affects Borderless: from n/a through = 1.7.3...
CVE-2024-34567
CVE-2024-34567 describes a Stored Cross-Site Scripting (XSS) vulnerability in Popup Builder for WordPress, affecting the Popup Builder plugin up to version 1.1.29. The issue is caused by improper input neutralization during web page generation, enabling storedXSS by authenticated actors. Connecte...
CVE-2024-34757
CVE-2024-34757 is a Stored XSS vulnerability (Improper Neutralization of Input During Web Page Generation) in Visualmodo Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg. The issue affects Borderless from version before 1.5.3, causing stored cross-site scripting thr...
PT-2024-24863 · Supsystic · Pricing-Table-By-Supsystic
Name of the Vulnerable Software and Affected Versions: Pricing Table by Supsystic versions 1.9.12 and earlier Description: The issue is related to improper neutralization of script-related HTML tags in a web page, which allows code injection. This is a basic XSS vulnerability. Recommendations: Fo...
CVE-2023-42773
Improper neutralization in IntelR Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2023-42773
Intel Power Gadget software for Windows (all versions) is affected by CVE-2023-42773 due to improper neutralization, potentially allowing an authenticated local user to escalate privileges. Root cause: improper neutralization in the Windows implementation. Impact: privilege escalation with high s...
CVE-2023-42773
Improper neutralization in IntelR Power Gadget software for Windows all versions may allow an authenticated user to potentially enable escalation of privilege via local access...