Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the servicetype parameter in services.inc.php. PoC Pass in a servicetype parameter value...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the hostname parameter in capture.inc.php, when creating a new device. PoC Pass in a...

CVE-2024-52369

Unrestricted Upload of File with Dangerous Type vulnerability in Optimal Access KBucket kbucket allows Upload a Web Shell to a Web Server.This issue affects KBucket: from n/a through = 4.2.2...

CVE-2024-52369 WordPress KBucket plugin <= 4.2.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Optimal Access KBucket kbucket allows Upload a Web Shell to a Web Server.This issue affects KBucket: from n/a through = 4.2.2...

CVE-2024-52369

CVE-2024-52369 affects WordPress KBucket plugin versions up to 4.1.6 and is an Unrestricted Upload of File with Dangerous Type vulnerability that allows upload of a web shell to the server. Connected records indicate patched status for KBucket, with fixes in later builds (e.g., 4.2.2+ as per Patc...

JVN#05136799: WordPress Plugin "VK All in One Expansion Unit" vulnerable to cross-site scripting

"Custom Alert Content" of WordPress Plugin "VK All in One Expansion Unit" provided by Vektor,Inc. contains a stored cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing the web site using the product. Solution Update...

CVE-2024-10218

XSS Attack in mar.jar, Monitoring Archive Utility MAR Utility, monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence...

CVE-2024-10218 TIBCO Hawk Stored-XEE Vulnerability

XSS Attack in mar.jar, Monitoring Archive Utility MAR Utility, monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence...

CVE-2024-10218

TIBCO Hawk and TIBCO Operational Intelligence (MAR Utility) are affected by CVE-2024-10218 due to a stored-XEE/XSS vulnerability in mar.jar and monitoringconsolecommon.jar. The issue could allow an attacker to read sensitive files on the host with the server’s privileges. Affected products/versio...

CVE-2024-10217

CVE-2024-10217 describes a stored XSS vulnerability in TIBCO Hawk and TIBCO Operational Intelligence, specifically in mar.jar (Monitoring Archive Utility) and monitoringconsolecommon.jar. The advisory details that a malicious .mar file could trigger XSS, potentially allowing an attacker to execut...

CVE-2024-10217 TIBCO Hawk Stored-XSS Vulnerability

XSS Attack in mar.jar, Monitoring Archive Utility MAR Utility, monitoringconsolecommon.jar in TIBCO Software Inc TIBCO Hawk and TIBCO Operational Intelligence...

CVE-2024-51781 WordPress Firework Shoppable Live Video plugin <= 6.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Stefan Backor Firework Shoppable Live Video firework-videos allows Reflected XSS.This issue affects Firework Shoppable Live Video: from n/a through = 6.3...

CVE-2024-51781

CVE-2024-51781 describes a reflected XSS in the Firework Shoppable Live Video WordPress plugin by Loop Now Technologies. Public details indicate improper neutralization of input during web page generation, enabling Reflected XSS affecting Firework Shoppable Live Video versions up to 6.3 (n/a to 6...

CVE-2024-50523

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through = 1.8.2...

CVE-2024-50523 WordPress All Post Contact Form plugin <= 1.8.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in RainbowLink Inc. All Post Contact Form allpost-contactform allows Upload a Web Shell to a Web Server.This issue affects All Post Contact Form: from n/a through = 1.8.2...

CVE-2024-50523

The CVE-2024-50523 entry documents an Unrestricted Upload of File with Dangerous Type vulnerability in the WordPress plugin All Post Contact Form, allowing an unauthenticated attacker to upload a web shell to the target server. Affected versions include

CVE-2024-37250

Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1...

CVE-2024-37249

Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1...

CVE-2024-37249 WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability

Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1...

CVE-2024-37250 WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerability

Missing Authorization vulnerability in WPEngine Inc. Advanced Custom Fields PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Custom Fields PRO: from n/a through 6.3.1...