Path Traversal

filegator/filegator is vulnerable to path traversal. Insufficient sanitization in joinPaths function allows remote authenticated attackers write,move and copy files outside of intended scope...

Security update for busybox (important)

SUSE Security Update: Security update for busybox Announcement ID: openSUSE-SU-2022:0135-1 Rating: important References: 1064976 1064978 1069412 1099260 1099263 1102912 1121426 1121428 1184522 1192869 1198676 1198677 1198678 1198679 1198680 1198703 951562 970662 970663 991940 Cross-References:...

GHSA-HCQ9-HMGF-6QR9 Drupal SQL Injection vulnerability

An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names...

Lansweeper WebUserActions Cross-Site Scripting (CVE-2022-21145)

A stored cross-site scripting vulnerability exists in Lansweeper. The vulnerability is due to insufficient sanitization of the loginmessage and loginfootertext parameters...

CVE-2022-1090

The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

jenkins-2-plugins/docker-commons: does not sanitize the name of an image or a tag which could result in an OS command execution

An OS command execution vulnerability was found in the Jenkins Docker Commons plugin. Due to a lack of sanitization in the name of an image or a tag, an attacker with Item/Configure permission or the ability to control the contents of a previously configured job’s SCM repository may be able to...

CVE-2022-25307 WP Statistics <= 13.1.5 Unauthenticated Stored Cross-Site Scripting via platform

The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the platform parameter found in the /includes/class-wp-statistics-hits.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when sit...

The vulnerability of the built-in Wi-Fi router software from NETGEAR, including models D7800, DM200, EX2700, EX6150v2, EX6100v2, EX6200v2, EX6250, EX6410, EX6420, EX6400v2, EX7300, EX6400, EX7320, EX7300v2, R7500v2, R7800, R8900, R9000, RAX120, RBK40, RBK20, RBR20, RBS20, RBK50, RBR50, RBS50, RBS50Y, and WN3000RPv2, WN3000RPv3, WNR2000v5, XR500, XR700, lies in the insufficient cleaning of special elements in the output data used by the incoming component. This allows attackers to execute a Server Side Include Injection (SSI) attack.

The vulnerability of the built-in Wi-Fi router software from NETGEAR, including models D7800, DM200, EX2700, EX6150v2, EX6100v2, EX6200v2, EX6250, EX6410, EX6420, EX6400v2, EX7300, EX6400, EX7320, EX7300v2, R7500v2, R7800, R8900, R9000, RAX120, RBK40, RBK20, RBR20, RBS20, RBK50, RBR50, RBS50,...

WordPress Download Manager Plugin Cross-Site Scripting (CVE-2021-24773)

A stored cross-site scripting vulnerability exists in Download Manager Plugin for WordPress. The vulnerability is due to insufficient sanitization of user-supplied data in Attach File section...

CVE-2021-24884

The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like ,,, and.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Lin...

CVE-2021-24884

The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like ,,, and.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Lin...

Design/Logic Flaw

The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like ,,, and.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Lin...

GHSA-JF9V-Q8VH-3FMC Cross-site scripting in ICEcoder

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the GET'replace' variable. As a result, arbitrary Javascript code can get executed...

Cross-site Scripting in LibreNMS

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

Cross site scripting

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

CVE-2021-31274

In LibreNMS description variable. As a result, arbitrary Javascript code can get executed...

CVE-2021-27910

CVE-2021-27910 describes a stored XSS in Mautic via the bounce management callback. The vulnerability arises from insufficient sanitization of the POST parameters error and error_related_to in the callback endpoint (POST /mailer//callback). An attacker with access to the callback can inject arbit...

PT-2021-6533 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.4 and up Description: The issue is related to insufficient input sanitization in Mermaid markdown, allowing a remote attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown. Th...

CVE-2021-32067

The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to insufficient output sanitization...

Fortinet FortiPortal 跨站脚本漏洞

Fortinet FortiPortal is an advanced, feature-rich managed security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for MSPs. A cross-site scripting vulnerability exists in the Fortinet FortiPortal GUI due to...