TRENDnet TEW-652BRP Cross-Site Scripting Vulnerability

TRENDnet TEW-652BRP is a wireless router from TRENDnet USA. TRENDnet TEW-652BRP getset.ccp suffers from a cross-site scripting vulnerability, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can obtain sensitive information or hijack user...

PT-2023-15579

Name of the Vulnerable Software and Affected Versions Jorani version 1.0 Description A cross-site scripting XSS issue was found in Jorani via the Acronym parameter. This allows for potential malicious script execution. Recommendations For Jorani version 1.0, avoid using the Acronym parameter unti...

Remote Code Execution (RCE)

dolphinscheduler-alert-script is vulnerable to Remote Code Execution. The vulnerability exists due to the improper validation of the script alert plugin parameter in the library, allowing an attacker to inject and execute malicious script alerts...

PT-2022-26820

Name of the Vulnerable Software and Affected Versions Inhabit Systems Pty Ltd Move CRM version 4, build 260 Description A cross-site scripting XSS issue was found in the User profile component. This allows for potential malicious script execution. Recommendations For Inhabit Systems Pty Ltd Move...

CVE-2022-3853

Cross-site Scripting XSS is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application...

MTN Group: Reflected cross site scripting (XSS) attacks Reflected XSS attacks,

The vulnerability summary is as follows: Reflected XSS attacks occur when a malicious script was reflected off of a web application to the victim's browser. The vulnerability was typically a result of incoming requests not being sufficiently sanitized, which allowed for the manipulation of a web...

PT-2022-27164 · Unknown · Garage Management System

Name of the Vulnerable Software and Affected Versions: Garage Management System version 1.0 Description: The issue is related to Cross Site Scripting XSS via the "/garage/php action/createBrand.php" API endpoint. This allows for potential malicious script injection. Recommendations: For Garage...

College Management System SQL注入漏洞

College Management System is a simple project organized by Code Projects. It is used to keep track of students, teachers, subjects, schedules and all things related to college. College Management System v1.0 suffers from a SQL injection vulnerability that can be exploited by an attacker to upload...

PT-2022-21296 · WordPress · Follow Me Plugin

Name of the Vulnerable Software and Affected Versions: Follow Me Plugin versions up to, and including, 3.1.1 Description: The issue is due to missing nonce validation on the FollowMeIgniteSocialMedia options page function, making it possible for unauthenticated attackers to modify the plugin's...

Input validation

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a common query in the Web Administration Console. On successful exploitation, an attacker can view or modify information causing a limited...

Cross site scripting

Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator...

CVE-2022-33322: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator...

CVE-2022-2864

The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the /includes/settings.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and...

What Does The Fox Hack? Breaking Down the Anonymous Fox F-Automatical Script

While performing routine security research, one of our threat analysts discovered the latest version of a Command and Control C2 script, which is referred to as F-Automatical within the script’s code and was commonly known as FoxAuto in older versions. This is the seventh version of this automati...

Consensys: CSV Injection at https://assets-paris-demo.codefi.network/

Summary: Hi consensys Security Team. I have found CSV Injection when generate report at https://assets-paris-demo.codefi.network/ CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program such as Microsoft Excel or...

PT-2022-26284

Name of the Vulnerable Software and Affected Versions kkFileView version 4.0 Description The issue is related to Cross Site Scripting XSS via the controller Filecontroller.java. This allows for potential malicious script execution. Recommendations For kkFileView version 4.0, consider disabling th...

PT-2022-25949 · Unknown · Rphone Module

Name of the Vulnerable Software and Affected Versions: rphone module affected versions not specified Description: The issue concerns a script in the rphone module that can be maliciously modified, potentially leading to the implantation of irreversible programs on user devices. Recommendations: A...

CVE-2022-41576

The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted on user devices...

CVE-2022-41576: Improper Control of Generation of Code

The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted on user devices...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a vulnerability in the rphone module where a script can be maliciously modified...