214 matches found
CVE-2023-3411
The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajaxstoresave function. This makes it possible for unauthenticated...
WordPress Plugin Church Admin 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Stored XSS on user "Write private message" function
Description An attacker can inject malicious executable scripts into the code of the message field. Proof of Concept Log in as a Member user, access Messages - Write private message function for sending admin a message.COde Insert this payload into the message field testscriptprompt'1'/script the...
WordPress Plugin File Away 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
Trend Micro Apex Central Cross-Site Scripting Vulnerability (CNVD-2023-57665)
Trend Micro Apex Central is a Web-based console from Trend Micro, Inc. A cross-site scripting vulnerability exists in Trend Micro Apex Central, which can be exploited by an attacker to inject malicious script or HTML code...
Iris 跨站脚本漏洞
Iris is a fast, simple, yet full-featured and very efficient Go web framework. A security vulnerability exists in Iris versions prior to 2.2.1, which stems from the presence of a stored cross-site scripting XSS vulnerability that allows an attacker to inject malicious script into an application,...
dico.malgache.free.fr Cross Site Scripting vulnerability OBB-3341878
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress Plugin Booqable Rental 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2023-30860
WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert...
WordPress Plugin WPGlobus Translate Options 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
CVE-2022-3853
Cross-site Scripting XSS is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application...
PT-2022-27164 · Unknown · Garage Management System
Name of the Vulnerable Software and Affected Versions: Garage Management System version 1.0 Description: The issue is related to Cross Site Scripting XSS via the "/garage/php action/createBrand.php" API endpoint. This allows for potential malicious script injection. Recommendations: For Garage...
CVE-2022-2864
The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the /includes/settings.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and...
Qsmart Next 跨站脚本漏洞
Qsmart Next is a free smartphone application from Qsmart Inc. A security vulnerability exists in Qsmart Next version v4.1.2, which can be exploited by an attacker to inject malicious scripts into other benign and trusted websites...
Remote Code Execution (RCE)
Redis is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the input allowing an attacker to inject maliciously crafted script into the system...
WordPress plugin Free Live Chat Support 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Free Live Chat Support...
Cross-site Scripting (XSS)
github.com/argoproj/argo-cd is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization allowing an attacker to inject maliciously crafted script via input in the /auth/callback page...
Cross-site Scripting (XSS)
Overview org.jenkins-ci.plugins:violations is a plugin that generates reports on static code violations Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker can inject arbitrary web script or HTML by sending a crafted request. Details Cross-site scripting or X...
NUUO Network Video Recorder 跨站脚本漏洞
NUUO Network Video Recorder NVR is a network video recorder from NUUO, Taiwan, China. A cross-site scripting vulnerability exists in NUUO Network Video Recorder NVRsolo version 3.9.1, which stems from the lack of effective filtering and escaping of user-submitted request parameters, and can be...
Remote Code Execution (RCE)
webkit2gtk is vulnerable to remote code execution. The vulnerability exists due to a memory corruption allowing an attacker to inject maliciously crafted script into the system...