1484 matches found
CVE-2022-2542
The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the /app/sites/ajax/actions/keywordsave.php file that is called via the doAjax function. This make...
PT-2022-17273
Name of the Vulnerable Software and Affected Versions uContext for Amazon plugin for WordPress versions up to, and including 3.9.1 Description The issue is related to Cross-Site Request Forgery to Cross-Site Scripting due to missing nonce validation in the /app/sites/ajax/actions/keyword save.php...
gomatrixserverlib 安全漏洞
gomatrixserverlib is a Go library open-sourced by matrix.org. Used for common functions required by the matrix server. A security vulnerability exists in gomatrixserverlib, which stems from the inability of its power level parsing program to parse the "eventsdefault" keyword of the...
CVE-2022-35121
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...
CVE-2022-35121
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...
CVE-2022-35121
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...
CVE-2022-35121
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...
CVE-2022-35121
CVE-2022-35121 affects Novel-Plus v3.6.1 with a SQL injection via the keyword parameter on the endpoint /service/impl/BookServiceImpl.java. The NVD entry lists a CVSS v3.1 base score of 9.8 (CRITICAL) with network attack vector, no privileges required, and user interaction not needed; impact is H...
PT-2022-22587 · Unknown · Novel-Plus
Name of the Vulnerable Software and Affected Versions: Novel-Plus version 3.6.1 Description: The issue is related to a SQL injection vulnerability. It occurs via the keyword parameter at the /service/impl/BookServiceImpl.java endpoint. Recommendations: For Novel-Plus version 3.6.1, consider...
novel-plus SQL注入漏洞
novel-plus novel-plus is a multi-end PC, WAP reading, full-featured original literature CMS system. A security vulnerability exists in novel-plus v3.6.1, which is caused by an SQL injection vulnerability in the keyword parameter /service/impl/BookServiceImpl.java...
CVE-2022-35121: Improper Neutralization of Special Elements used in an SQL Command
Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...
PT-2022-21623
Name of the Vulnerable Software and Affected Versions Asus DSL-N14U-B1 version 1.1.2.3 805 Description A Cross Site Scripting XSS issue exists in the router Asus DSL-N14U-B1 via the "list" parameters e.g. filter lwlist, keyword rulelist, etc in every ".asp" page containing a list of stored string...
Cross-site Scripting (XSS)
com.jfinal:jfinal is vulnerable to cross-site scriptingXSS attacks. A remote attacker is able to inject and execute arbitrary javascript via a crafted payload injected into the keyword text field under the publish blog module...
74cmsSE SQL Injection Vulnerability (CNVD-2022-61441)
74cmsSE is a free, open source professional recruiting system based on PHP MYSQL. 74cmsSE is vulnerable to SQL injection, which results from a lack of validation of externally entered SQL statements in the /home/job/index keyword parameter. An attacker could use this vulnerability to execute...
Page Generator Plugin < 1.6.6 - Arbitrary Keywords Deletion/Duplication via CSRF
The plugin does not have CSRF check in place when deleting and duplicating keywords, which could allow attackers to make a logged in admin delete and duplicate arbitrary keywords via CSRF attacks PoC https://example.com/wp-admin/admin.php?page=page-generator-keywords=delete=3...
Page Generator Plugin < 1.6.5 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Got to Page Generator - Keywords - Add Keyword and put the following payload in the "Terms" field then...
GHSA-9PVQ-4CC7-24JG Cross-site Scripting in Jfinal CMS
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module...
_updateTwav() and _getTwav() will revert when cumulativePrice overflows
Lines of code Vulnerability details Impact Contract will break when cumulativeValuation overflows. PoC Cumulative prices are designed to work with overflows/underflows because in the end the difference is important. In updateTwav when prevCumulativeValuation + valuation timeElapsed overflows the...