Arbitrary Code Execution

@advanced-rest-client/base is vulnerable to arbitrary code execution. The vulnerability exists in the hasHeaders function of HeadersListElement.js, allowing an attacker to inject and execute malicious scripts through the target link in the response headers, which may lead to gaining access to...

MTN Group: cross site scripting reflected

The vulnerability was a cross-site scripting XSS flaw that allowed arbitrary JavaScript to be executed on the target website. The payload '-alert1-' was reflected in the website's output, demonstrating the presence of the vulnerability...

CVE-2021-4030

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts...

CVE-2021-4030

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts...

CVE-2021-4030

CVE-2021-4030 describes a cross-site request forgery in the HTTP daemon of Zyxel ARMOR Z1/Z2 firmware. By tricking a local user into visiting a malicious site, an attacker could coerce the user to execute arbitrary commands on the device via the compromised HTTP daemon. The provided documents con...

CVE-2021-4030

A cross-site request forgery vulnerability in the HTTP daemon of the Zyxel ARMOR Z1/Z2 firmware could allow an attacker to execute arbitrary commands if they coerce or trick a local user to visit a compromised website with malicious scripts...

Cross-site Scripting (XSS) - Reflected

Description Can escape the meta tag because the user doesn't escape the double-quote in the $redirectUrl parameter when logging out. Proof of Concept txt https:///demo/api/logout?redirectto=/asdf" Impact Through this vulnerability, an attacker is capable to execute malicious scripts...

Cross-site Scripting (XSS)

librenms is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of input via the dashboardname allowing an attacker to inject maliciously crafted scripts into the system...

Arbitrary Code Execution

vm2 is vulnerable to arbitrary code execution. Remote attackers are able to inject and execute crafted malicious scripts on the host machine via direct access to host error objects generated by node internals during generation of a stacktraces...

Cross-site Scripting (XSS) - Reflected in orchardcms/orchardcore

Description Reflected XSS is found under DesignShortcodeNew Shortcode Proof of Concept POC Video https://drive.google.com/file/d/1yFfa7g8MMUvJrrKTpJXZEHhQLRSZ1Cii/view?usp=sharing Impact Through this vulnerability, an attacker is capable to execute malicious scripts...

Cross-site Scripting (XSS)

pimcore/pimcore is vulnerable to cross-site scripting. The vulnerability exists in website.js because it doesn't properly escape the grid values which allows an attacker to send and execute malicious scripts...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce services. stored xss vulnerability occurs when you change the value of Abbreviation, Longname, Converter Service at "Settings" = "Data Objects" = "Quantity Value" in the...

Cross-site Scripting (XSS)

pimcore/pimcore is vulnerable to cross-site scripting XSS. The attack exists because names parameters on import are not sanitized, allowing an attacker to inject malicious scripts...

Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat

Description Stored XSS is found in SettingsLive help configurationDepartments-Departments groups-edit When a user creates a new webhook under the NAME field and puts a payload constructor.constructor'alert1', the input gets stored, at user edit groupname , the payload gets executed. Proof of...

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Vuln : Stored XSS Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce services. stored xss vulnerability occurs when you change the value of name at "Setinngs" = "Website Settings" in the pimcore service. Proof of Concept...

Cross-site Scripting (XSS) - Stored in vanessa219/vditor

Description The Vanessa219/vditor is a markdown editor supported by browsers. If the user passes javascript:alertdocument.domain as the URL value when creating a link using the markdown syntax, there is no sanitizing process and the link is created as it is. Proof of Concept txt XSS PoC : xss 1...

Cross-site Scripting (XSS) - Stored in vanessa219/vditor

Description The Vanessa219/vditor is a markdown editor supported by browsers. When a user creates a link using the markdown syntax, the server does not URL-encode the double-quotes, so the user can escape the href attribute and trigger XSS using the on attribute. Proof of Concept txt XSS PoC : xs...

Unrestricted File Upload

pimcore/pimcore allows unrestricted file uploads. The vulnerability exists due to a lack of sanitization of the file type during upload allowing local authenticated attackers to execute malicious scripts on the server...

Cross-site Scripting (XSS)

icecoder/icecoder is vulnerable to cross-site scripting. The vulnerability exists in editor.php because the conditions are not properly handled which allows an attacker to craft and send malicious scripts to an unsuspecting user...

Cross-site Scripting (XSS)

pimcore/pimcore is vulnerable to cross-site scripting XSS attacks. An attacker is able to bypass the validations due to improper input neutralization during web page generation. The vulnerability can be exploited via changing the rule name in the admin dev page allowing attackers to inject and...