Cross-site Scripting (XSS)

getgrav/grav is vulnerable to cross site scripting. The vulnerability exists due to lack of sanitization of regular expression in the detectXss function allowing an attacker to inject maliciously crafted script via the browser in onX events...

WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464)

Binary data wso2CVE-2022-29464.nbin...

Cross-site Scripting (XSS)

Overview org.jenkins-ci.plugins:violations is a plugin that generates reports on static code violations Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker can inject arbitrary web script or HTML by sending a crafted request. Details Cross-site scripting or X...

Cross-site Scripting (XSS)

snipe/snipe-it is vulnerable to cross-site scripting. Lack of sanitization of the user requestable results enable an attacker to inject malicious script to steal user cookie...

Remote Code Execution (RCE)

composer/composer is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the user-controlled $file or $identifier arguments via the VcsDriver::getFileContent allowing an attacker to inject maliciously crafted script into the system...

CVE-2021-22797

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation when a malicious project file is loaded in the...

Remote Code Execution (RCE)

apostrophe is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of input via the component uploadfs allowing an attacker to inject maliciously crafted script into the system...

Remote Code Execution (RCE)

Apache Struts is vulnerable to remote code execution. The vulnerability exists due to an incomplete fix of CVE-2020-17530 which is double evaluation if OGNL is used, allowing an attacker to inject maliciously crafted script via the %... syntax within the Struts tag...

Cross-site Scripting (XSS)

privatebin is vulnerable to cross-site scripting. No sanitization in handling Attachment before sending for preview in SVG in AttachmentViewer allows malicious script execution in instance context...

CVE-2022-26676

CVE-2022-26676 concerns the product aEnrich a+HRD . The vulnerability stems from inadequate privilege restrictions on an API function, enabling an unauthenticated remote attacker to upload and execute malicious scripts, potentially allowing control of the system or disruption of services. This al...

Cross-site Scripting (XSS)

wwbn/avideo is vulnerable to cross-site scripting. The getDeviceID method does not properly handle the $device parameter, allowing an attacker to inject malicious script into victim's browser via yptDevice to view/include/head.php...

Cross-site Scripting (XSS)

tastyigniter/tastyigniter is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of the html DOM tags allowing an attacker to inject maliciously crafted script into the system...

Medical Hub Directory Site 1.0 Cross Site Scripting

Title: Medical Hub Directory Site 1.0 XSS Stored Author: Hejap Zairy Date: 30.07.2022 Vendor: https://www.sourcecodester.com/php/15252/simple-medical-hub-directory-site-phpoop-source-code.html Software:https://www.sourcecodester.com/sites/default/files/download/oretnom23/mhds.zip Reference:...

Medical Hub Directory Site 1.0 Cross Site Scripting Vulnerability

Title: Medical Hub Directory Site 1.0 XSS Stored Author: Hejap Zairy Vendor: https://www.sourcecodester.com/php/15252/simple-medical-hub-directory-site-phpoop-source-code.html Software:https://www.sourcecodester.com/sites/default/files/download/oretnom23/mhds.zip Reference:...

CVE-2021-27418 GE UR family input validation

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTM...

CVE-2021-27418 GE UR family input validation

GE UR firmware versions prior to version 8.1x supports web interface with read-only access. The device fails to properly validate user input, making it possible to perform cross-site scripting attacks, which may be used to send a malicious script. Also, UR Firmware web server does not perform HTM...

Inventory Management System 1.0 Cross Site Scripting Vulnerability

Title: Inventory Management System 1.0 XSS Stored Author: Hejap Zairy Vendor: https://www.vetbossel.in/inventory-management-system-php/ Software: https://cutt.ly/lOZ8lrr Reference: https://github.com/Matrix07ksa Tested on: ArchLinux, MySQL, Apache Description: Stored XSS, also known as persistent...

Remote Code Execution (RCE)

post-loader is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization in an unsecure parser which allows an attacker to execute maliciously crafted script in the system...

Remote Code Execution (RCE)

ckeditor4 is vulnerable to remote code execution. The vulnerability exists due to lack of sanitization malformed HTML allowing an attacker to inject maliciously crafted script...

Remote Code Execution (RCE)

microweber is vulnerable to remote code execution. The vulnerability exists due a lack of verification of a zip file in the Backup/Restore feature, allowing an attacker to inject maliciously crafted script into the system...