Remote Code Execution (RCE)

webkit2gtk is vulnerable to remote code execution. The vulnerability exists due to a type confusionallowing an attacker to inject maliciously crafted script via web content...

Remote Code Execution (RCE)

webkit2gtk is vulnerable to remote code execution. The vulnerability exists due to an out-of-bounds read allowing an attacker to inject maliciously crafted script via web content...

CVE-2022-23127

Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the...

CVE-2022-23127

Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the...

CVE-2021-44176: Improper Neutralization of Input During Web Page Generation

AEM's Cloud Service offering, as well as version 6.5.10.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

PT-2022-12546

Name of the Vulnerable Software and Affected Versions Vehicle Service Management System version 1.0 Description A Stored Cross Site Scripting XSS issue exists via the My Account Section in the login panel. This allows for malicious script execution. Recommendations For Vehicle Service Management...

Cross-site Scripting (XSS) - Stored in erudika/scoold

Description The Schold is a Q&A/knowledge base platform written in Java. When writing a Q&A, you can use the markdown editor. So I tried to exploit the syntax to try an XSS attack. It seemed to validate javascript: on the backend. So I couldn't use it. However, according to RFC3986, the scheme ca...

NUUO Network Video Recorder 跨站脚本漏洞

NUUO Network Video Recorder NVR is a network video recorder from NUUO, Taiwan, China. A cross-site scripting vulnerability exists in NUUO Network Video Recorder NVRsolo version 3.9.1, which stems from the lack of effective filtering and escaping of user-submitted request parameters, and can be...

Cross-Site Scripting (XSS)

gaoming13/wechat-php-sdk is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in serve function in 'Wechat.php', allowing an attacker to inject and execute malicious script...

CVE-2021-44164

Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or...

CVE-2021-44164

The CVE-2021-44164 entry concerns Chain Sea AI chatbot system; its file upload function lacks robust filtering for special URL characters, allowing bypass of file type validation and remote code execution without authentication. Impact is system take-over or service termination as described; conn...

Remote Code Execution (RCE)

librecad is vulnerable to remote code execution. The vulnerability exists due to a heap buffer overflow in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw allowing a specially-crafted .dwg file execute maliciously crafted script...

Sofico Miles Ria跨站脚本漏洞

Sofico Miles Ria is a car rental management software from Sofico Belgium. A security vulnerability exists in Sofico Miles RIA version 2020.2 build 127964T, which allows an attacker to create a malicious work order in the damase report section or change an existing work order using a malicious...

Orangescrum 1.8.0 Cross Site Scripting

Exploit Title: orangescrum 1.8.0 - 'Multiple' Cross-Site Scripting XSS Authenticated Date: 28/11/2021 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Company: https://redteam.pl Vendor Homepage: https://www.orangescrum.org/ Software Link: https://www.orangescrum.org/...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90759)

Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90764)

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited by...

Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90761)

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited by...

CVE-2021-43409

The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...

Cross site scripting

The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...

Cross-Site Scripting (XSS)

hoteldruid is vulnerable to cross-site scripting. The vulnerability exists due to lack of sanitization of user input which allows an attacker to inject malicious script to the system...