503 matches found
Stored XSS in Notifications
Description It is possible to create a notification with stored XSS which can result in the JavaScript code execution. Notifications can only be created while logged in on user with admin privileges, but once notification is created any user can see it. Proof of Concept Create notification with...
Cross site scripting
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements...
CVE-2021-46680
CVE-2021-46680 affects Pandora FMS versions prior to 756 (i.e., 756 and earlier). The vulnerability is a cross-site scripting (XSS) flaw in the module form name field, enabling an attacker to execute JavaScript in the context of the affected web interface. Reported across multiple sources (NVD en...
CVE-2021-46681
PT-2022-12901 (PT Security) provides concrete details for CVE-2021-46681: affected software Pandora FMS versions 756 and below with a Cross-Site Scripting vulnerability in the module massive operation name field that enables execution of JavaScript code. The report notes there is no information a...
CVE-2021-46680: Improper Neutralization of Input During Web Page Generation
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the module form name field...
CVE-2021-46678: Improper Neutralization of Input During Web Page Generation
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the service name field...
CVE-2021-46679: Improper Neutralization of Input During Web Page Generation
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via service elements...
CVE-2021-46677: Improper Neutralization of Input During Web Page Generation
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the event filter name field...
CVE-2021-46681: Improper Neutralization of Input During Web Page Generation
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name field...
PT-2022-12898 · Unknown · Pandora Fms
Name of the Vulnerable Software and Affected Versions: Pandora FMS versions prior to 756 Description: A XSS issue exists that allows an attacker to execute javascript code via the service name field. Recommendations: For versions prior to 756, update to a version above 756 to resolve the issue...
CVE-2021-46676: Improper Neutralization of Input During Web Page Generation
A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via the transactional maps name field...
CVE-2022-31175: Improper Neutralization of Input During Web Page Generation
CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...
PT-2022-20575
Name of the Vulnerable Software and Affected Versions jQuery UI versions prior to 1.13.2 Description Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call .checkboxradio "refresh" on such a widget and th...
CVE-2021-41420
A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context of authenticated and unauthenticated users through the MaianAffiliate admin panel...
CVE-2021-41420: Improper Neutralization of Input During Web Page Generation
A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context of authenticated and unauthenticated users through the MaianAffiliate admin panel...
GHSA-V3H2-4J2R-WQJ8 Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console
The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protection...
October CMS XSS
October CMS build 412 is vulnerable to stored XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...
GHSA-3P6C-9XHM-8X7H October CMS XSS
October CMS build 412 is vulnerable to stored XSS in brand logo image name resulting in JavaScript code execution in the victim's browser...
CVE-2022-1464: Improper Neutralization of Input During Web Page Generation
Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...