2345 matches found
NUUO Network Video Recorder 跨站脚本漏洞
NUUO Network Video Recorder NVR is a network video recorder from NUUO, Taiwan, China. A cross-site scripting vulnerability exists in NUUO Network Video Recorder NVRsolo version 3.9.1, which stems from the lack of effective filtering and escaping of user-submitted request parameters, and can be...
Cross-Site Scripting (XSS)
gaoming13/wechat-php-sdk is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in serve function in 'Wechat.php', allowing an attacker to inject and execute malicious script...
CVE-2021-44164
Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or...
CVE-2021-44164
The CVE-2021-44164 entry concerns Chain Sea AI chatbot system; its file upload function lacks robust filtering for special URL characters, allowing bypass of file type validation and remote code execution without authentication. Impact is system take-over or service termination as described; conn...
Remote Code Execution (RCE)
librecad is vulnerable to remote code execution. The vulnerability exists due to a heap buffer overflow in the dwgCompressor::copyCompBytes21 functionality of LibreCad libdxfrw allowing a specially-crafted .dwg file execute maliciously crafted script...
Sofico Miles Ria跨站脚本漏洞
Sofico Miles Ria is a car rental management software from Sofico Belgium. A security vulnerability exists in Sofico Miles RIA version 2020.2 build 127964T, which allows an attacker to create a malicious work order in the damase report section or change an existing work order using a malicious...
Orangescrum 1.8.0 Cross Site Scripting
Exploit Title: orangescrum 1.8.0 - 'Multiple' Cross-Site Scripting XSS Authenticated Date: 28/11/2021 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Company: https://redteam.pl Vendor Homepage: https://www.orangescrum.org/ Software Link: https://www.orangescrum.org/...
Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90764)
Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited by...
Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90759)
Open-xchange OX App Suite is a web-based cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited...
Open-xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-90761)
Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A cross-site scripting vulnerability exists in Open-xchange OX App Suite, which can be exploited by...
CVE-2021-43409
The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...
Cross site scripting
The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...
Cross-Site Scripting (XSS)
hoteldruid is vulnerable to cross-site scripting. The vulnerability exists due to lack of sanitization of user input which allows an attacker to inject malicious script to the system...
Darwin Factor 跨站脚本漏洞
Darwin Factor is a free and open source next-generation TypeScript framework from the U.S. company Darwin . Used to create blogs , login pages and JamStack applications . Darwin Factor has a cross-site scripting vulnerability , the vulnerability stems from the vulnerability to reflected cross-sit...
CVE-2021-42839 Grand Vice info Co. webopac7 - Arbitrary File Upload
Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services...
Employee and Visitor Gate Pass Logging System 1.0 - (name) Stored Cross-Site Scripting Vulnerability
Exploit Title: Employee and Visitor Gate Pass Logging System 1.0 - 'name' Stored Cross-Site Scripting XSS Exploit Author: İlhami Selamet Vendor Homepage: https://www.sourcecodester.com/php/15026/employee-and-visitor-gate-pass-logging-system-php-source-code.html Software Link:...
Cross-site Scripting (XSS) - Stored in tsolucio/corebos
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites Proof of Concept Step to Reproduce: 1 Go to http://demo.corebos.com/index.php?module=Users&action=DetailView&record=1&modechk=prefview 2 add the...
CVE-2020-15940
An improper neutralization of input vulnerability CWE-79 in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server...
CVE-2020-15940
An improper neutralization of input vulnerability CWE-79 in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server...
Remote Code Execution (RCE)
webkit2gtk is vulnerable to arbitrary code execution. The vulnerability exists due to a memory corruption allowing an attacker to inject maliciously crafted script into the system...