CVE-2025-45960

CVE-2025-45960 - tawk.to Live chat - 1.6.1 - Cross-Site Scripting XSS Vulnerabilidad Confirmado en 1.6.1 versiones anteriores probablemente afectadas Descripción: Se encontró que la aplicación web almacena y muestra datos proporcionados por el usuario sin la validación o codificación adecuada. Es...

CVE-2021-20717

CVE-2021-20717-EC-CUBE-XSS Descripción de NVD Una vulnerabilidad de cross-site scripting en EC-CUBE 4.0.0 a 4.0.5 permite a un atacante remoto inyectar un script especialmente diseñado en el campo de entrada específico del sitio web EC creado con EC-CUBE. Como resultado, puede provocar la ejecuci...

CVE-2022-25063

CVE-2022-25063 Este script explota una vulnerabilidad XSS en el router TPLink WR840N, utilizando un campo para inyectar código JavaScript...

CVE-2024-51032

CVE-2024-51032 Description A Cross-site Scripting XSS vulnerability in managerecipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "owner" input field. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

CVE-2024-31026

An issue in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module...

CVE-2024-31026

An issue in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module...

PT-2026-102822

Name of the Vulnerable Software and Affected Versions Greek Universities Network GUnet Open eClass Platform version 3.15 Description A remote attacker can execute arbitrary code through the chat input field within the course module. This issue is a code injection, which occurs when an application...

CVE-2024-31026: Undefined Security Weakness

An issue in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module...

CVE-2024-31026

The Greek Universities Network (GUnet) Open eClass Platform v.3.15 is vulnerable to a code injection flaw. A remote attacker can exploit the chat input field within the course module to execute arbitrary code on the system. To remediate this issue, users should update the platform to a version th...

EUVD-2024-55775

An issue in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module...

EUVD-2026-63793

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

EUVD-2026-63796

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

CVE-2026-77391

SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 is vulnerable to cross-site request forgery (CSRF) via an unidentified function. CVSS 4.0 scores it MEDIUM (5.3); the attack is remote, requires no privileges and passive user interaction, with integrity impact. A proof-of-...

CVE-2026-77392: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-77391: Cross-Site Request Forgery (CSRF)

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

Mocodo vulnerable to SQL injection in `/web/generate.php`

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sqlcase input field in /web/generate.php, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution RCE under certain conditions...

EUVD-2021-34850

WordPress Plugin WP24 Domain Check 1.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the fieldnameDomain parameter. Attackers can inject JavaScript payloads through the plugin settings form at...

CVE-2019-25736 LabF nfsAxe 3.7 Ping Client Buffer Overflow

LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload in the Host IP field. Attackers can craft a specially formatted input file with shellcode and overwrite the return address to execute calc.ex...

CVE-2019-25742: Improper Neutralization of Input During Web Page Generation

WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execu...

CVE-2019-25737: Improper Neutralization of Input During Web Page Generation

Live Chat Unlimited 2.8.3 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the chat input field. Attackers can submit payloads containing script tags and event handlers that execute in the admin area, enabling cookie...