CVE-2023-40819: Improper Neutralization of Input During Web Page Generation

ID4Portais in version V.2022.837.002a returns message parameter unsanitized in the response, resulting in a HTML Injection vulnerability...

Tailoring Management System SQL Injection Vulnerability

Tailoring Management System is a tailoring management system from itsourcecode open source. A SQL injection vulnerability exists in itsourcecode Tailoring Management System version 1.0, which stems from the parameter title/msg in the file templateadd.php that can lead to SQL injection...

CVE-2024-6427

Uncontrolled Resource Consumption vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can use the "message" parameter to inject a payload with dangerous JavaScript code, causing the application to loop requests on itself, which could lead to resource consumption and...

CVE-2024-6427: Uncontrolled Resource Consumption

Uncontrolled Resource Consumption vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can use the "message" parameter to inject a payload with dangerous JavaScript code, causing the application to loop requests on itself, which could lead to resource consumption and...

CVE-2023-49111: Improper Neutralization of Input During Web Page Generation

For Kiuwan installations with SSO single sign-on enabled, an unauthenticated reflected cross-site scripting attack can be performed on the login page "login.html". This is possible due to the request parameter "message" values being directly included in a JavaScript block in the response. This is...

PT-2024-13677

Name of the Vulnerable Software and Affected Versions Kiuwan SAST version Description The issue allows for an unauthenticated reflected cross-site scripting attack on the login page "login.html" when SSO single sign-on is enabled. This is due to the message request parameter values being directly...

Ingenico Estate Manager Cross-Site Scripting Vulnerability

Ingenico Estate Manager is a real estate management software from Ingenico Japan. A cross-site scripting vulnerability exists in Ingenico Estate Manager version 2023, which stems from cross-site scripting due to misuse of the parameter message...

PT-2024-37353 · Ingenico · Ingenico Estate Manager

Name of the Vulnerable Software and Affected Versions: Ingenico Estate Manager version 2023 Description: A problematic issue has been found in the News Feed component, affecting the processing of the file /emgui/rest/ums/messages. The manipulation of the message argument leads to cross-site...

playSMS Security Vulnerabilities

playSMS is an open source SMS Short Message Service management software from Anton Raharja, an individual developer in India. A security vulnerability exists in playSMS 1.4.7 and earlier versions, which stems from the fact that manipulation of the parameters name/message can lead to basic...

CVE-2024-3469

The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

PT-2024-26109

Name of the Vulnerable Software and Affected Versions GP Premium plugin for WordPress versions up to, and including, 2.4.0 Description The issue is related to Reflected Cross-Site Scripting via the message parameter due to insufficient input sanitization and output escaping. This allows...

VulnCheck KEV: CVE-2024-3469

The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-3469: Improper Neutralization of Input During Web Page Generation

The GP Premium plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-3473: Improper Neutralization of Input During Web Page Generation

The Header Footer Code Manager Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in all versions up to, and including, 1.0.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2024-26143 · WordPress · Header Footer Code Manager

Name of the Vulnerable Software and Affected Versions: Header Footer Code Manager Pro plugin for WordPress versions up to, and including, 1.0.16 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing unauthenticated...

Campcodes Online Event Management System 跨站脚本漏洞

Campcodes Online Event Management System is an online event management system. A cross-site scripting vulnerability exists in Campcodes Online Event Management System version 1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the msg parameter of the...

CVE-2024-1412

The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ and 'error' parameters in all versions up to, and including, 1.11.26 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2024-21310 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.11 Description: The issue is related to Stored Cross-Site Scripting via the countdown widget's message parameter due to insufficient input sanitization...

CVE-2024-2623: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the countdown widget's message parameter in all versions up to, and including, 5.9.11 due to insufficient input sanitization an...

Campcodes Online Event Management System 跨站脚本漏洞

Campcodes Online Event Management System is an online event management system from Campcodes, Inc. A cross-site scripting vulnerability exists in Campcodes Online Event Management System version 1.0, which originates from an unknown function in /views/index.php that causes cross-site scripting vi...