FacturaScripts Cross-Site Scripting Vulnerability (CNVD-2022-76230)

FacturaScripts is an ERP software. cross-site scripting vulnerability exists in versions prior to FacturaScripts 2022.07, which can be exploited by attackers to execute arbitrary javascript code, steal user cookies, execute HTTP requests, obtain "same-origin " page content, etc...

WordPress AdRotate plugin cross-site scripting vulnerability (CNVD-2022-59803)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23. The...

Shopizer Cross-Site Scripting Vulnerability (CNVD-2022-70092)

Shopizer is a Java-based e-commerce solution from the Shopizer team. 2.0 to 2.17.0 versions of Shopizer are vulnerable to a cross-site scripting vulnerability in which the file name under the "Manage Files" tab lacks validation filters for user-supplied and output data. An attacker could use this...

Micro Focus NetIQ Access Manager Cross-Site Scripting Vulnerability (CNVD-2022-76231)

Micro Focus NetIQ Access Manager is a resource access control solution from Micro Focus, a UK-based company. A cross-site scripting vulnerability exists in versions prior to Micro Focus NetIQ Access Manager 5.0.2, which stems from a lack of data validation filtering of user-supplied data and...

Cyclos 4 PRO Cross-Site Scripting Vulnerability (CNVD-2022-77956)

Cyclos 4 PRO is a web server. a cross-site scripting vulnerability exists in Cyclos 4 PRO version 4.14.7 and earlier, which stems from a failure to validate user input during error notification. A remote, unauthenticated attacker could execute javascript code via undefine enumeration constants...

WordPress Event List plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Event List plugin versions prior to 0.8.8 contain a cross-site scripting vulnerability that stems...

WordPress AdRotate plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23, which st...

WordPress Import and export users and customers plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Import and export users and customers plugin...

Remote code execution

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code...

CVE-2022-1464

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...

IBM InfoSphere Information Server Cross-Site Scripting Vulnerability (CNVD-2022-38556)

IBM InfoSphere Information Server is a data integration platform from IBM in the United States. IBM InfoSphere Information Server version 11.7 contains a cross-site scripting vulnerability. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and...

IBM InfoSphere Information Server Cross-Site Scripting Vulnerability (CNVD-2022-66262)

IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. A cross-site scripting vulnerability exists in IBM InfoSphere Information Server version 11.7, which can be...

CVE-2022-1464: Improper Neutralization of Input During Web Page Generation

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...

JetBrains IntelliJ IDEA Cross-Site Scripting Vulnerability

JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from Jetbrains Czech Republic.A cross-site scripting vulnerability exists in versions prior to JetBrains IntelliJ IDEA 2022.1, which stems from an error message in the internal web server that lacks a...

PT-2022-13983

Name of the Vulnerable Software and Affected Versions microweber versions prior to 1.2.16 Description The issue is related to a reflected cross-site scripting XSS flaw. This flaw allows an attacker to execute JavaScript code as the victim, potentially leading to unauthorized actions on the victim...

WordPress Stafflist 3.1.2 Cross Site Scripting Vulnerability

Exploit Title: WordPress Plugin stafflist 3.1.2 - Reflected XSS Authenticated Exploit Author: Hassan Khan Yusufzai - Splint3r7 Vendor Homepage: https://wordpress.org/plugins/stafflist/ Version: 3.1.2 Tested on: Firefox Contact me: h at spidersilk.com Summary: A cross site scripting reflected...

PT-2022-13955

Name of the Vulnerable Software and Affected Versions microweber versions prior to 1.2.16 Description The issue allows for DOM XSS, enabling the injection of arbitrary JavaScript code, which can lead to defacement of a website or stealing cookies. The software in question is a drag and drop websi...

CVE-2021-31674

Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant...

Input validation

Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant...

CVE-2021-31674

Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant...