1093 matches found
Best Contact Management Software <= 3.7.3 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the "No Access Message" settings...
CVE-2022-29250 SQL injection in GLPI
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user...
CVE-2022-29250
GLPI vulnerability CVE-2022-29250 affects versions before 10.0.1. A SQL injection flaw on search pages allows a logged-in user to potentially modify information. Root cause: unsafely concatenated/retrieved search queries enabling injection. Impact: integrity is HIGH, confidentiality/availability ...
CVE-2022-29250 SQL injection in GLPI
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user...
CVE-2022-24876
CVE-2022-24876 is a stored cross-site scripting vulnerability in GLPI’s Kanban view. Public details confirm that versions prior to 10.0.1 are vulnerable to HTML injection via a user’s name, enabling a user-controllable script that could affect other users whenKanban pages are loaded. The issue is...
MV Informática IDCE MV SQL Injection Vulnerability
MV Informática IDCE MV is a health management software from the Brazilian company MV Informática. MV Informática IDCE MV version 1.0 contains a SQL injection vulnerability that stems from a SQL injection issue in the user field of the login page. An attacker could exploit the vulnerability to...
PartKeepr Cross-Site Scripting Vulnerability
A cross-site scripting vulnerability exists in PartKeepr version 1.4.0, which is an inventory management software designed primarily for electronic components. The vulnerability stems from a security issue in the name field in /api/partcategories. An attacker could exploit this vulnerability to...
GHSA-MHFV-9H99-JWG7 Mediawiki Improper Privilege Management
Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'...
CVE-2022-26564
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting XSS vulnerability via the prezzoperiodo4 parameter in creaprezzi.php...
DEBIAN-CVE-2022-26564
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting XSS vulnerability via the prezzoperiodo4 parameter in creaprezzi.php...
CVE-2022-26564
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting XSS vulnerability via the prezzoperiodo4 parameter in creaprezzi.php...
Cross site scripting
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting XSS vulnerability via the prezzoperiodo4 parameter in creaprezzi.php...
UBUNTU-CVE-2022-26564
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting XSS vulnerability via the prezzoperiodo4 parameter in creaprezzi.php...
CVE-2022-26564
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting XSS vulnerability via the prezzoperiodo4 parameter in creaprezzi.php...
Weak Password Vulnerability in TAS Management Console of Beijing Huayu Information Technology Co.
Ltd. is an intelligent information service company with software and information service as its main business. A weak password vulnerability exists in the TAS management console of Beijing Huayu Information Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information...
CVE-2022-24869
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack...
CVE-2022-24869
CVE-2022-24869 affects GLPI releases prior to 10.0.0. The issue allows cross-site scripting via a stylesheet link injected in ticket followups or login messages, enabling an attacker to execute script in a user’s browser. Root cause: improper handling of stylesheet references in those areas. Impa...
CVE-2022-24868 Cross site scripting via SVG file upload in GLPI
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user...
Red Hat 3scale 输入验证错误漏洞
Red Hat 3scale is a suite of API Application Programming Interface lifecycle management software from Red Hat. A security vulnerability exists in the Red Hat 3scale system that originates from a script injection issue in multiple endpoints...
Schneider Electric ConneXium Network Manager Software 安全漏洞
Schneider Electric ConneXium Network Manager Software Schneider Electric Cnm is an industrial Ethernet network management software from Schneider Electric France. A security vulnerability exists in the Schneider Electric ConneXium Network Manager Software. An attacker with physical access could...