PT-2022-22196

Name of the Vulnerable Software and Affected Versions Digital Watchdog DW MEGApix IP cameras version A7.2.2 20211029 Description A cross-site scripting XSS issue was found in the bia oneshot.cgi component. This allows for potential malicious script execution. Recommendations For version A7.2.2...

CVE-2022-2039

The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupportisettings function found in the /livesupporti.php file. This makes it possible for unauthenticated attacke...

WordPress plugin Free Live Chat Support 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Free Live Chat Support...

PT-2022-9000

Name of the Vulnerable Software and Affected Versions sourcecodester Multi Restaurant Table Reservation System version 1.0 Description The issue is related to a Cross Site Scripting XSS vulnerability. It can be exploited via the Item Name field to the "/dashboard/menu-list.php" API endpoint. This...

Cross-site Scripting (XSS)

github.com/argoproj/argo-cd is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization allowing an attacker to inject maliciously crafted script via input in the /auth/callback page...

The vulnerability of the thread_call() function in the Squirrel programming language allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the threadcall function in the Squirrel programming language is related to the execution of operations outside of memory buffers. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code using a specially created malware fi...

EyouCms Cross-Site Scripting Vulnerability (CNVD-2022-62185)

eyoucms is a content management system. A cross-site scripting vulnerability exists in the eyoucms login page, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to obtain sensitive information or hijack user sessions when malicious...

PT-2022-21102

Name of the Vulnerable Software and Affected Versions 74cmsSE version 3.5.1 Description A reflective cross-site scripting XSS issue was found in the component /index/jobfairol/show/. This issue allows for the execution of malicious scripts on the client-side, potentially leading to unauthorized...

Remote Code Execution (RCE)

grub2 is vulnerable to remote code execution. The vulnerability exists due to an out-of-bounds write in the heap area allowing an attacker to inject maliciously crafted script into the system via a crafted 16-bit grayscale PNG image which allows an attacker to inject malicious codes...

Remote Code Execution (RCE)

grub2 is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the data pointer of the JPEG reader allowing an attacker to inject maliciously crafted script into the system via a crafted JPEG image...

Cross-site Scripting (XSS)

facturascripts/facturascripts is vulnerable to cross site scripting. The vulnerability exists due to a lack of sanitization of the username field allowing an attacker to input maliciously crafted script via the username field when showing 'login-user-not-found' message...

PT-2022-20369

Name of the Vulnerable Software and Affected Versions Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" Description The issue is related to Cross-Site Scripting XSS and can be exploited via the admin-MaintenanceDevice Management section. Thi...

Cross-site Scripting (XSS)

francoisjacquet/rosariosis is vulnerable to cross-site scripting. The vulnerability exists because it does not escape HTML entities from URL in PreparePHPSELF.fnc.php, allowing an attacker to inject and execute malicious script...

stored xss

Description Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Proof of Concept 1Go to this website: https://titra.io/ 2Click on add Track button 3In the Task field enter...

Remote Code Execution (RCE)

firefox is vulnerable to remote code execution. The vulnerability exists due to memory corruption allowing an attacker to inject maliciously crafted script into the system...

Magento stored cross-site scripting vulnerability

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s brows...

Stored Cross Site Scripting on "Add user" field

Steps to reproduce: 1. Go to settings-- Access controls -- Add user 2. Payload = """ 3. Add XSS payload as username and create a new user 4. After creating the user, click on delete button and the XSS will be triggered POC Screenshot:...

Remote Code Execution (RCE)

tiddlywiki is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the upload function allowing an attacker to inject maliciously crafted script via a crafted SVG file...

PT-2022-20000

Name of the Vulnerable Software and Affected Versions WBCE CMS version 1.5.2 Description The issue is related to Cross Site Scripting XSS and can be exploited via the /admin/users/save.php endpoint. This allows for malicious script execution. No information is provided about the estimated number ...

Remote Code Execution (RCE)

firefox is vulnerable to remote code execution. The vulnerability exists due to a memory corruption allowing an attacker to inject maliciously crafted script into the system...