CVE-2022-2517

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value associated with images in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2022-2935 Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URL

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media Image URL value that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2022-2936 Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Video Link

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values that can be added to an Image Hover in versions up to, and including, 9.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2021-31139

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting XSS vulnerabilities...

Magento Commerce 跨站脚本漏洞

Magento Commerce is to provide a first-class shopping experience without the need for developer support. Magento Commerce suffers from a cross-site scripting vulnerability that exists due to insufficient cleaning of user-supplied data. A remote attacker can exploit this vulnerability to inject an...

CVE-2021-22185

Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki...

PT-2021-3088 · Microsoft · Sharepoint Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft SharePoint Server affected versions not specified Description: The vulnerability in Microsoft SharePoint Server is related to insufficient input sanitization, allowing a remote attacker to execute arbitrary code. In a network-based...

Flexmonster Pivot Table And Charts 2.7.17 Cross Site Scripting

Exploit Title: CVE-2020-20140 : Cross Site Scripting XSS vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17 Date: 08/01/2020 Exploit Author: Marco Nappi Vendor Homepage: n/a Software Link: n/a Version:Flexmonster Pivot Table & Charts 2.7.17...

Cisco SD-WAN vManage Software RCE (cisco-sa-vmanrce-4jtWT28P)

According to its self-reported version, Cisco SD-WAN vManage is affected by a remote code execution vulnerability in its user authentication processing component due to insufficient user input sanitization. An authenticated, remote attacker can exploit this to bypass authentication and execute...

PT-2020-21534

Name of the Vulnerable Software and Affected Versions f-serv versions affected versions not specified Description The issue is related to Path Traversal due to insufficient input sanitization in URLs. Attackers can access server files by using relative paths when fetching files. Recommendations A...

Apple Mac OS X Security Update (HT211170) - 01

Apple Mac OS X is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-0069: Out-of-bounds Write

In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

GHSA-CGJV-RGHQ-QHGP Path Traversal in algo-httpserv

Versions of algo-httpserv prior to 1.1.2 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to version 1.1.2 or later...

Path Traversal

Overview All versions of static-resource-server are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...

Path Traversal in servey

Versions of servey prior to 3.x are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to the latest version...

GHSA-2HHW-P8MG-JRM6 Path Traversal in http-live-simulator

Versions of http-live-simulator prior to 1.0.6 are vulnerable to Path Traversal. Due to insufficient input sanitization, attackers can access server files by using relative paths. Recommendation Upgrade to version 1.0.6...

LAquis SCADA Web Server Command Injection (CVE-2018-18992)

A command injection exists in LAquis SCADA web server. The vulnerability is due to insufficient input sanitization, which permits command injection. A remote attacker could exploit this vulnerability by sending a crafted request to an affected server...

PT-2019-19251

Name of the Vulnerable Software and Affected Versions Total.js Platform versions prior to 3.2.3 Description The issue allows path traversal due to insufficient input sanitization in URLs, enabling attackers to access server files outside the /public folder by using relative paths. The files serve...

CVE-2018-9072

In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization during file downloads...

PT-2018-14045

Name of the Vulnerable Software and Affected Versions Teltonika RUT9XX routers with firmware prior to 00.05.01.1 Description The issue is related to cross-site scripting due to insufficient user input sanitization in the hotspotlogin.cgi file. Recommendations For firmware versions prior to...