PT-2023-30645 · Unknown · Bootstrap Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: Bootstrap Shortcodes Ultimate versions 4.3.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can injec...

PT-2023-7631 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version V9.4.0cu.852 B20230719 Description: The issue exists due to the lack of neutralization of special elements used in the operating system command. This allows a remote attacker to execute arbitrary commands. The sub 4119...

PT-2023-32657 · Unknown · Bigprof Online Invoicing System

Name of the Vulnerable Software and Affected Versions: BigProf Online Invoicing System version 2.6 Description: A vulnerability has been discovered in the BigProf Online Invoicing System, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the...

PT-2023-26407 · Enfold · Enfold

Name of the Vulnerable Software and Affected Versions: Enfold - Responsive Multi-Purpose Theme versions n/a through 5.6.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

Schweitzer Engineering Laboratories SEL-411L Cross-Site Scripting Vulnerability

Schweitzer Engineering Laboratories SEL-411L is a state-of-the-art line differential protection, automation, and control system from Schweitzer Engineering Laboratories, USA. A security vulnerability exists in the Schweitzer Engineering Laboratories SEL-411L that stems from improper neutralizatio...

CVE-2023-47833

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jeroen Schmit Theater for WordPress plugin = 0.18.3 versions...

CVE-2023-47834

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ExpressTech Quiz And Survey Master plugin = 8.1.13 versions...

Medart Health Services SQL Injection Vulnerability

Medart Health Services is an application from Medart, Inc. A SQL injection vulnerability exists in Medart Health Services Medart Notification Panel version 20231123 and prior versions, which stems from improper neutralization of special elements...

KC Group E-Commerce Software Cross-Site Scripting Vulnerability

KC Group E-Commerce Software is an e-commerce software from the Turkish company KC Group. A cross-site scripting vulnerability exists in KC Group E-Commerce Software version 20231123 and prior versions, which arises from improper input neutralization during web page generation...

PT-2023-28108 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS. This enables the execution of Javascript code in the news section of the...

CVE-2023-47813

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in grandslambert Better RSS Widget plugin = 2.8.1 versions...

CVE-2023-47817

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mmrs151 Daily Prayer Time plugin = 2023.10.13 versions...

CVE-2023-47812

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bamboo Mcr Bamboo Columns plugin = 1.6.1 versions...

The vulnerability of the /users/ad-search-result.php web application for phpipam allows a violator to disclose protected information.

The vulnerability of the /users/ad-search-result.php web application for managing IP addresses in phpipam exists due to the failure to take measures to neutralize specific elements. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

USN-6492-1 mosquitto vulnerabilities

Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. CVE-2021-34431...

USN-6491-1: Node.js vulnerabilities

Axel Chong discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. CVE-2022-32212 Zeyu Zhang discovered that Node.js incorrectl...

CVE-2023-48199

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

CVE-2023-48199

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

Design/Logic Flaw

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

jetty: Improper addition of quotation marks to user inputs in CgiServlet

A flaw was found in Jetty's CGI servlet which permits incorrect command execution in specific circumstances such as requests with certain characters in requested filenames. This issue could allow an attacker to run permitted commands other than the one requested...