Exploit for Cross-site Scripting in Vanillaforums Vanilla

CVE-2020-8825 Publish: CVE-2020-8825https:...

PT-2020-20308

Name of the Vulnerable Software and Affected Versions Vanilla version 2.6.3 Description The issue allows for stored XSS in the index.php?p=/dashboard/settings/branding endpoint. Recommendations For version 2.6.3, update to a newer version that contains a fix for this issue...

CVE-2020-8825: Improper Neutralization of Input During Web Page Generation

index.php?p=/dashboard/settings/branding in Vanilla 2.6.3 allows stored XSS...

CVE-2012-4029

Cross-site scripting XSS vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the categoryname parameter in an addsentcategory action...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

CVE-2014-9127: Exposure of Sensitive Information to an Unauthorized Actor

Open-School Community Edition 2.2 does not properly restrict access to the export functionality, which allows remote authenticated users to obtain sensitive information via the r parameter with the value export to index.php...

PT-2020-7770

Name of the Vulnerable Software and Affected Versions: Open-School Community Edition version 2.2 Description: The issue concerns improper access restriction to the export functionality. Remote authenticated users can obtain sensitive information by exploiting this weakness. Specifically, the "r"...

CVE-2014-9126: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Open-School Community Edition 2.2 allow remote attackers to inject arbitrary web script or HTML via the YIICSRFTOKEN HTTP cookie or the StudentDocument, StudentCategories, StudentPreviousDatas parameters to index.php...

PT-2020-7769

Name of the Vulnerable Software and Affected Versions: Open-School Community Edition version 2.2 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the YII CSRF TOKEN HTTP cookie ...

CVE-2012-4029: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the categoryname parameter in an addsentcategory action...

CVE-2020-8641

Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php pageslug parameter...

CVE-2020-8641

Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php pageslug parameter...

PT-2020-20250

Name of the Vulnerable Software and Affected Versions Lotus Core CMS version 1.0.1 Description The issue allows authenticated Local File Inclusion of .php files via directory traversal in the page slug parameter of the index.php page. Recommendations For Lotus Core CMS version 1.0.1, consider...

CVE-2020-8641: Improper Limitation of a Pathname to a Restricted Directory

Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php pageslug parameter...

PT-2020-7089

Name of the Vulnerable Software and Affected Versions Vanilla Forums versions 2.0.17.1 through 2.0.17.5 Description The issue is related to a cross-site scripting XSS vulnerability. It affects the /vanilla/index.php endpoint via the p parameter. Recommendations For versions 2.0.17.1 through...

CVE-2013-2623

Cross-site Scripting XSS in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "femail" parameter in index.php...

Cross site scripting

Cross-site Scripting XSS in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "femail" parameter in index.php...

CVE-2013-2623

Cross-site Scripting XSS in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "femail" parameter in index.php...

CVE-2013-2623: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in Telaen before 1.3.1 allows remote attackers to inject arbitrary web script or HTML via the "femail" parameter in index.php...

PT-2020-7402

Name of the Vulnerable Software and Affected Versions: Telaen versions prior to 1.3.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the f email parameter in "index.php". Recommendations: For versions prior to 1.3.1, update to version 1.3.1 or later to...