Rocket.Chat Search Messages Cross-Site Scripting Vulnerability

Rocket.Chat is an open source team chat software. Rocket.Chat Search Messages suffers from a cross-site scripting vulnerability that can be exploited by a remote attacker to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack a user's session when...

Exploit for CVE-2022-30190

CVE 30190 Amine TITROFINE | December 17, 2022 ------------...

Automattic: Stored XSS on wordpress.com

A Stored XSS vulnerability was found on WordPress.com via app.crowdsignal.com. An attacker could use this vulnerability to execute malicious script code in the victim user's browser and redirect them to malicious sites...

Rockwell Automation ArmorStart ST 跨站脚本漏洞

Rockwell Automation ArmorStart ST is a simple and cost-effective solution for machine-side control architectures from Rockwell Automation. The Rockwell Automation ArmorStart ST suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject malicious script or HTM...

WordPress Plugin Booqable Rental 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Pimcore 跨站脚本漏洞

pimcore an open source data and experience management platform. A cross-site scripting vulnerability exists in versions of Pimcore prior to 10.5.21, which can be exploited by attackers to inject malicious JavaScript scripts...

SAP BusinessObjects Business Intelligence Platform 跨站脚本漏洞

SAP BusinessObjects Platform is a centralized suite for data reporting, visualization, and sharing from SAP, Germany. A cross-site scripting vulnerability exists in SAP BusinessObjects Platform, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to...

CVE-2023-30860

WWBN AVideo is an open source video platform. In AVideo prior to version 12.4, a normal user can make a Meeting Schedule where the user can invite another user in that Meeting, but it does not properly sanitize the malicious characters when creating a Meeting Room. This allows attacker to insert...

CVE-2023-30860

CVE-2023-30860 affects WWBN AVideo prior to version 12.4. A normal user can create a Meeting Schedule and invite others, but input is not properly sanitized when creating a Meeting Room, allowing insertion of malicious scripts. Any user, including admins, can view the meeting room, enabling cooki...

Cross-site Scripting (XSS) in pimcore

Impact An attacker can use XSS to send a malicious script to any user. Patches Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/6970649f5d3790a1db9ef4324bece0d4cb95366a.patch Workarounds Apply patch...

Stored XSS and CSP Bypass in KiwiTCMS

Description Stored XSS, also known as persistent XSS, is the more damaging of the XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Due to a sanitization problem it is possible to perform a Stored XSS. The problem is that the upload function permit...

CVE-2023-30459

SmartPTT SCADA 1.1.0.0 allows remote code execution when the attacker has administrator privileges by writing a malicious C script and executing it on the server via server settings in the administrator control panel on port 8101, by default...

Cross-Site Scripting Vulnerability in Cisco Unified Contact Center Express

Cisco Unified Contact Center Express is the customer relationship management component of a unified communications solution from the U.S. company Cisco Cisco. A cross-site scripting vulnerability exists in Cisco Unified Contact Center Express, which can be exploited by remote attackers to inject...

WordPress Plugin WPGlobus Translate Options 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2023-29015

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting ...

Cross site scripting

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following ...

CVE-2023-29015 Goobi viewer Core has Cross-Site Scripting Vulnerability in User Comments

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A cross-site scripting vulnerability has been identified in the user comment feature of Goobi viewer core prior to version 23.03. An attacker could create a specially crafted comment, resulting ...

CVE-2023-29014

CVE-2023-29014 describes a reflected cross-site scripting vulnerability in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could lure a user to a crafted link, causing malicious script execution in the browser. Multiple connected records confirm the issue...

CVE-2023-29014 Goobi viewer Core Reflected Cross-Site Scripting Vulnerability Using LOGID Parameter

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization via the metrics endpoint. PoC https://localhost/sidekiq/metrics?period=%22%3E%3Cimg/src/onerror=alertdocument.domain%3E...