60 matches found
CVE-2021-47690
Nagios XI CCM (Core Config Manager) before CCM 3.1.1/Nagios XI 5.8.2 contains multiple XSS vulnerabilities in Overlay modals due to insufficient validation/escaping of user input. Affected component: CCM Overlay modals; impact is browser-exjected scripts. Root cause: input validation/escaping wea...
PT-2025-44474
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to CCM 3.1.1 Nagios XI versions prior to 5.8.2 Description The Core Config Manager CCM in Nagios XI is susceptible to multiple cross-site scripting XSS issues within Overlay modals. A lack of proper input validation or...
CVE-2025-55035
Mattermost Desktop App versions =5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their server which allows an attacker that provides a malicious server to the user to deny use of the Desktop App via having th...
CVE-2020-29587
SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html function to directly...
Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041
Colorbox is a module that allows Images, and iframed or inline content to be displayed in a modal above the current page. The Colorbox module doesn't sufficiently sanitize data attributes before opening modals. This vulnerability is mitigated by the fact that an attacker must have a role with...
Orchid Platform has Method Exposure Vulnerability in Modals
Impact This vulnerability is a method exposure issue CWE-749: Exposed Dangerous Method or Function in the Orchid Platform’s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within t...
GHSA-CM46-GQF4-MV4F Orchid Platform has Method Exposure Vulnerability in Modals
Impact This vulnerability is a method exposure issue CWE-749: Exposed Dangerous Method or Function in the Orchid Platform’s asynchronous modal functionality, affecting users of Orchid Platform version 8 through 14.42.x. Attackers could exploit this vulnerability to call arbitrary methods within t...
CVE-2024-51992 Method Exposure Vulnerability in Modals in orchid/platform
Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability is a method exposure issue CWE-749: Exposed Dangerous Method or Function in the Orchid Platform’s asynchronous modal functionality, affecti...
PT-2024-7861 · Unknown · Orchid Platform
Name of the Vulnerable Software and Affected Versions: Orchid Platform versions 8 through 14.42.x Description: The issue is a method exposure problem in the Orchid Platform’s asynchronous modal functionality, allowing attackers to call arbitrary methods within the Screen class. This could lead to...
Brave Desktop 1.67.123 Security Fixes
Fixed unreadable button labels on certain YubiKey modals when using light theme. Upgraded Chromium to 126.0.6478.126 — refer to Google Chrome advisories for inherited CVEs...
CVE-2023-6619
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /modals/classform.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to th...
Sql injection
A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /modals/classform.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to th...
CVE-2023-6619
The CVE-2023-6619 entry concerns SourceCodester Simple Student Attendance System 1.0. A vulnerability exists in the file /modals/class_form.php where manipulation of the id parameter enables SQL injection. The vulnerability is publicly disclosed and integrated across multiple feeds (NVD, RH, CVE ...
SourceCodester Simple Student Attendance System SQL Injection Vulnerability
Simple Student Attendance System is a simple student attendance system. SourceCodester Simple Student Attendance System version 1.0 has a SQL injection vulnerability that originates from a SQL injection vulnerability in the file /modals/classform.php...
Magecart threat actor rolls out convincing modal forms
To ensnare new victims, criminals will often devise schemes that attempt to look as realistic as possible. Having said that, it is not every day that we see the fraudulent copy exceed the original piece. While following up on an ongoing Magecart credit card skimmer campaign, we were almost fooled...
Malicious code in usaa-modals (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a20b88dd9f95f9a8e4e3f0a4b31a9ed24bd83360e7f038df10d5e0f1a61555d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6847 Malicious code in usaa-modals (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a20b88dd9f95f9a8e4e3f0a4b31a9ed24bd83360e7f038df10d5e0f1a61555d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
DRUPAL-CONTRIB-2018-074
This base theme bridges the gap between Drupal and the Bootstrap Framework. The theme doesn't sufficiently filter valid targets under the scenario of opening modals, popovers, and tooltips. This vulnerability is mitigated by the fact that an attacker must already have the ability to either: 1...
desertluxuryestates.com XSS vulnerability
Vulnerable URL: https://desertluxuryestates.com/modals/property-inquiry.php?id=15011%22--!%3E%3CSvg/OnLoad=confirmOPENBUGBOUNTY%3E%22 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 17.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...
Robert 0.5 - Multiple Vulnerabilities
Exploit Title: Robert 0.5 - Multiple Vulnerabilities XSS, CSRF, Directory traversal & SQLi Date: 07/06/2017 Exploit Author: Cyril Vallicari / HTTPCS - ZIWIT Vendor website :http://robert.polosson.com/ Download link : https://github.com/RobertManager/robert/archive/master.zip Live demo :...