2345 matches found
Crosss-Site Scripting (XSS)
wordpress is vulnerable to cross-site scripting XSS. The stats method of class-wp-object-cache.php does not sanitize the user-provided data, allowing an attacker to inject malicious script to be executed when a user loads the page...
Remote Code Execution (RCE)
pixl-class is vulnerable to remote code execution RCE. The attack is possible because it uses eval function in class.js, allowing an attacker to inject malicious script and to get executed...
Cross-site Scripting (XSS)
Croogo is vulnerable to cross-site scripting XSS. The attacker can inject malicious script in the title parameter of admin/menus/menus or admin/taxonomy/vocabularies, causing the malicious script to be executed when a user visits the page...
CVE-2020-11813
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...
Cross site scripting
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...
CVE-2020-11813
In Rukovoditel 2.5.2, there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus, an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous...
Cross-Site Scripting (XSS)
squirrelmail is vulnerable to cross-site scripting. Insufficient HTML mail sanitization allows a remote attacker to send a specially-crafted HTML mail or attachment that could cause a user's Web browser to execute a malicious script in the context of the SquirrelMail session when that email or...
CVE-2020-11629
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to...
Cross-Site Scripting (XSS)
Opencart is vulnerable to cross-site scripting XSS. The attack is possible because it does not sanitize the filename argument in the image upload section of admin panel, allowing an attacker to inject malicious script and get the script executed when a user visits the Image manager section...
Cross-site Scripting (XSS)
github.com/influxdata/influxdb is vulnerable to cross-site scripting XSS. The attack exists due to lack of validation of input value to the Write Data module, allowing an attacker to inject malicious script...
Cross-site Scripting (XSS)
gwtupload-samples is vulnerable to cross-site scripting XSS. The attack is possible because it allows the attacker to input malicious file names using the upload functionality, leading to an execution of malicious script when the filename is processed...
Cross-site Scripting (XSS)
dolibarr is vulnerable to cross-site scripting XSS. The attack exists because it does not properly HTML encoded to sanitize $SERVER"HTTPREFERER" arguments, allowing an attacker to inject and execute malicious script...
Information disclosure
A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information...
Magento cross-site scripting vulnerability (CNVD-2020-04821)
Magento is an open source e-commerce framework. Magento suffers from a stored cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to obtain sensitive information or hijack user sessions when malicious data is view...
CVE-2020-3925
A Remote Code ExecutionRCE vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts...
IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting
Title: IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting Date: 2020-01-27 Author: Lutfu Mert Ceylan Vendor Homepage: www.icewarp.com Tested on: Windows 10 Versions: 11.4.4.1 and before Vulnerable Parameter: "color" Get Method Google Dork: inurl:/webmail/ intext:Powered by IceWarp Server...
This Week in Security News: Over 2,000 WordPress Accounts Compromised and Facebook to Pay $550M to Settle Class Action Case Over Facial Recognition
Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, over two thousand WordPress sites were compromised using a malicious script that redirects visitors to scam websites. Also, read about how...
Cross-site Scripting (XSS)
ratpack-core is susceptible to cross-site scripting XSS. It does not sanitize the user input rendered as an exception message in the development error handler, allowing an attacker to inject malicious script via the message.The library is vulnerable only through the development mode's error handl...
Cross-site Scripting (XSS)
nifi-web-api is vulnerable to cross-site scripting XSS. It does not handle error response properly, allowing an unauthenticated user when using the application with Firefox to inject malicious script via UI through action. Note: this vulnerability does occur in other browsers...