OneNav v0.9.35-20240318 - Server-Side Request Forgery (SSRF)

OneNav v0.9.35-20240318 is vulnerable to server-side request forgery SSRF via the url parameter in the getlinkinfo API. An attacker can force the server to make arbitrary requests, potentially accessing internal resources. id: CVE-2024-33832 info: name: OneNav v0.9.35-20240318 - Server-Side Reque...

Intelbras TIP200/TIP200LITE/TIP300 - Cross-Site Scripting

Intelbras TIP200 60.61.75.15, TIP200LITE 60.61.75.15, and TIP300 65.61.75.15 are vulnerable to reflected cross-site scripting XSS via the page parameter in /cgi-bin/cgiServer.exx, allowing attackers to execute arbitrary JavaScript in the context of the user. id: CVE-2020-12262 info: name: Intelbr...

Hostel < 1.1.5.3 - Cross-Site Scripting

The Hostel WordPress plugin before 1.1.5.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2024-3753 info: name: Hostel 1.1.5.3 - Cross-Site Scriptin...

System Dashboard < 2.8.10 - Cross-Site Scripting

The System Dashboard WordPress plugin before 2.8.10 does not sanitize and escape some parameters, which could allow administrators in multisite WordPress configurations to perform Cross-Site Scripting attacks through header injection, specifically in the X-Forwarded-For header. id: CVE-2023-7246...

TOTVS Fluig Platform - Cross-Site Scripting

A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input...

Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting

A PHP script in the source code release echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting XSS vulnerability exploitable through Cross-Site Request Forgery CSRF. id: CVE-2025-47204 info: name: Bootstr...

Altenergy Power Control Software - SQL Injection

A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function getstatuszigbee of the file /index.php/display/statuszigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated...

Gitea 1.22.0 - Cross-Site Scripting

Gitea 1.22.0 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability allows an attacker to inject malicious scripts that get stored on the server and executed in the context of another user's session. id: CVE-2024-6886 info: name: Gitea 1.22.0 - Cross-Site Scripting...

Guten Free Options - Cross Site Scripting

Guten Free Options WordPress plugin = 0.9.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click malicious link. id: CVE-2024-13492 info: name: Guten Free...

Dash Framework - Cross-site Scripting

Dash framework versions before 2.15.0 are vulnerable to Cross-site Scripting XSS via href attribute in anchor tags. This template tests for javascript:alert payload injection. id: CVE-2024-21485 info: name: Dash Framework - Cross-site Scripting author: Lee Changhyuneeche severity: medium...

BestWebSoft's Twitter < 2.55 - Cross-Site Scripting

The twitter-plugin plugin before 2.55 for WordPress has XSS. id: CVE-2017-18505 info: name: BestWebSoft's Twitter 2.55 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The twitter-plugin plugin before 2.55 for WordPress has XSS. impact: | Authenticated attackers can...

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. id: CVE-2017-17059 info: name: WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress...

CVE-2021-46074

CVE-2021-46074 Titolo dell'exploit: Vehicle Service Management System - 'Impostazioni' Cross Site Scripting XSS persistente Autore dell'exploit: SANU P.L CVE: CVE-2021-46074 CVSS: 4.8 MEDIO Riferimenti:...

CVE-2025-46181-XSS

CVE-2025-46181 - XSS Riflesso in un Sistema di Prenotazione Appuntamenti Online CVE-ID : CVE-2025-46181 Scoperto da : Shemkumar P shemkumar.github.io Tipo di Vulnerabilità : Cross-Site Scripting Riflesso XSS Gravità : Media Stato : Divulgato, CVE Assegnato da MITRE ✨ Descrizione Esiste una...

Thruk-CVE-2023-34096

Thruk-CVE-2023-34096 Le versioni = v3.06 di Thruk Monitoring Web Interface sono vulnerabili a CVE-2023-34096 Path Traversal. L'exploit attuale è realizzato in Python 3 e sfrutta la vulnerabilità per caricare un file PoC in diverse cartelle comuni di Thruk e anche in alcune cartelle Linux. CVSS Il...

CVE-2021-46068

CVE-2021-46068 Titolo dell'Exploit: Vehicle Service Management System - 'MyAccount' Cross Site Scripting Memorizzato XSS Autore dell'Exploit: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MEDIO Riferimenti: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xs...

CVE-2021-46078

CVE-2021-46078 Exploit Title: Vehicle Service Management System - 'Mehrere' Datei-Uploads führen zu Stored Cross-Site Scripting Exploit Author: SANU P.L CVE: CVE-2021-46078 CVSS: 4.8 MEDIUM Referenzen:...

CVE-2021-46069

CVE-2021-46069 Titolo Exploit: Vehicle Service Management System - 'Elenco Meccanici' Stored Cross Site Scripting XSS Autore Exploit: SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 MEDIUM Riferimenti: https://www.plsanu.com/vehicle-service-management-system-mechanic-list-stored-cross-site-scripting-xss...

CVE-2023-29489

CVE-2023-29489 La vulnerabilità di sicurezza è registrata nel sistema Common Vulnerabilities and Exposures CVE. Nello specifico, questa vulnerabilità è legata a cPanel, un popolare software di gestione hosting. Questo difetto consente attacchi di cross-site scripting XSS tramite richieste...

CVE-2021-46080

CVE-2021-46080 Exploit-Titel: Vehicle Service Management System – „Mehrere“ Cross-Site-Request-Forgery CSRF führen zu Stored Cross-Site-Scripting XSS Exploit-Autor: SANU P.L CVE: CVE-2021-46080 CVSS: 4.8 MEDIUM Referenzen:...