Hostel Management System 2.1 Cross Site Scripting

Exploit Title: Hostel Management System 2.1 - Cross Site Scripting XSS Date: 26/12/2021 Exploit Author: Chinmay Vishwas Divekar Vendor Homepage: https://phpgurukul.com/hostel-management-system/ Software Link: https://phpgurukul.com/hostel-management-system/ Version: V 2.1 Tested on: PopOS20.10...

Hostel Management System 2.1 - Cross Site Scripting Vulnerability

Exploit Title: Hostel Management System 2.1 - Cross Site Scripting XSS Exploit Author: Chinmay Vishwas Divekar Vendor Homepage: https://phpgurukul.com/hostel-management-system/ Software Link: https://phpgurukul.com/hostel-management-system/ Version: V 2.1 Tested on: PopOS20.10 Steps to reproduce ...

Hostel Management System 2.1 - Cross Site Scripting (XSS)

Exploit Title: Hostel Management System 2.1 - Cross Site Scripting XSS Date: 26/12/2021 Exploit Author: Chinmay Vishwas Divekar Vendor Homepage: https://phpgurukul.com/hostel-management-system/ Software Link: https://phpgurukul.com/hostel-management-system/ Version: V 2.1 Tested on: PopOS20.10...

PT-2021-16205

Name of the Vulnerable Software and Affected Versions The Quiz Tool Lite WordPress plugin versions 2.3.15 and earlier Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization in multiple input fields used for creating or managing...

CVE-2021-42370: Cleartext Storage of Sensitive Information

A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in the device properties. Viewing the passwords requires configuring a web browser to display HTML password input fields...

PT-2021-23600

Name of the Vulnerable Software and Affected Versions XoruX LPAR2RRD versions prior to 7.30 STOR2RRD versions prior to 7.30 Description A password mismanagement situation exists because cleartext information is present in HTML password input fields in the device properties. Viewing the passwords...

CVE-2020-28956

Multiple cross-site scripting XSS vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields...

Cross site scripting

Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the firstname and lastname parameters of the registration form & loginsystem input fields...

CVE-2020-23051

Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the firstname and lastname parameters of the registration form & loginsystem input fields...

CVE-2020-28957

Multiple cross-site scripting XSS vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields...

CVE-2020-28957: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields...

Foxlor cross-site scripting vulnerability

Foxlor is This open source GPL panel was developed by experienced server administrators to simplify the job of managing hosting platforms. A security vulnerability exists in Foxlor, which can be exploited by an attacker to execute arbitrary web script or HTML by entering a payload in the name,...

Local Services Search Engine Management System Cross-Site Script Vulnerabilities

Local Services Search Engine Management System is a local services search engine management system. A cross-site scripting vulnerability exists in the Local Services Search Engine Management System Project, which stems from a persistent cross-site scripting vulnerability discovered in the Local...

Cross site scripting

The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting XSS vulnerability within the Forms "Add new" field...

AKCP sensorProbe Cross-Site Scripting Vulnerability

The AKCP sensorProbe is a platform-independent environmental and safety monitoring device from AKCP USA. Simply assign an IP address and connect to the embedded web server. A cross-site scripting vulnerability exists in versions prior to SP480-20210624 of the AKCP sensorProbe Embedded Web Server...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2021-45145)

MantisBT is a lightweight, free and open source, web-based defect tracking system. A cross-site scripting vulnerability exists in managecustomfieldeditpage.php in versions of MantisBT prior to 2.25.2. An attacker can exploit this vulnerability to inject code into hidden input fields...

MantisBT cross-site scripting vulnerabilities

MantisBT is a lightweight, free and open source, web-based defect tracking system. A cross-site scripting vulnerability exists in managecustomfieldeditpage.php in versions of MantisBT prior to 2.25.2. An attacker can exploit this vulnerability to inject code into hidden input fields...

Request a Quote < 2.3.4 - Authenticated Stored XSS

The plugin did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table. Note: By default, admins and editors are allowed to use JavaScript in posts and page, unless the...

Ec-cube cross-site scripting vulnerabilities

Ec-cube is an open source e-commerce system of the Japanese company Ec-cube . A cross-site scripting vulnerability exists in Ec-Cube, which can be exploited by a remote attacker to inject specially crafted scripts into specific input fields of an EC website created using EC-Cube and execute...

CVE-2021-24320

The Bello - Directory & Listing WordPress theme before 1.6.0 did not properly sanitise and escape its listinglistview, btbblistingfieldmylat, btbblistingfieldmylng, btbblistingfielddistancevalue, btbblistingfieldmylatdefault, btbblistingfieldkeyword, btbblistingfieldlocationautocomplete,...