CVE-2024-28142 Stored cross site scripting

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "File Name" page /cgi/uset.cgi?-cfilename in the User Settings menu improperly filters the "file name" and wildcard character input field. By...

LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section

A stored cross-site scripting XSS vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter...

CVE-2024-53470

Multiple stored cross-site scripting XSS vulnerabilities in the component /configuracao/gatewaypagamento.php of WeGIA v3.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the id or name parameter...

CVE-2024-53471

Multiple stored cross-site scripting XSS vulnerabilities in the component /configuracao/meiopagamento.php of WeGIA v3.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the id or name parameter...

PT-2024-35751 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA version 3.2.0 Description: The issue concerns multiple stored cross-site scripting XSS vulnerabilities in the /configuracao/meio pagamento.php component. Attackers can execute arbitrary web scripts or HTML via a crafted payload injected...

LibreNMS 安全漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of the network environment and automatic updates. A security vulnerability exists in LibreNMS versions v24.9.0 through v24.10.0. An...

CVE-2024-53457

A stored cross-site scripting XSS vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter...

WeGIA 安全漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A security vulnerability exists in WeGIA version v3.2.0. An attacker can exploit the vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload with the id or name...

CVE-2024-53457

CVE-2024-53457 details a stored XSS in LibreNMS (Device Settings, Display Name) for versions 24.9.0–24.10.0. The underlying issue enables arbitrary web scripts/HTML execution via crafted payloads. Public sources corroborate the affected product and version range and identify the remediation: upgr...

Cross-site Scripting (XSS)

Overview pyspider is an A Powerful Spider System in Python Affected versions of this package are vulnerable to Cross-site Scripting XSS through the /update endpoint due to improper sanitization of the name parameter. Note: To successfully exploit this vulnerability in a real-life scenario, the...

PySpider 安全漏洞

pyspider is a powerful web crawler system open-sourced by Roy Binux. A security vulnerability exists in PySpider version 0.3.10 and earlier, which stems from a failure to properly clean up the name parameter, allowing cross-site scripting attacks via the /update endpoint...

PT-2024-16821 · WordPress · Embedpress

Name of the Vulnerable Software and Affected Versions: EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin for WordPress versions up to, and including, 4.1.3 Description: The issue is related to...

CodeAstro Hospital Management System 安全漏洞

CodeAstro Hospital Management System is a hospital management system from CodeAstro, Inc. A security vulnerability exists in CodeAstro Hospital Management System version 1.0 that stems from incorrect manipulation of the parameters vname, vadr, vnumber, vemail, vphone, and vdesc can lead to...

PT-2024-17170 · Code Projects · Code-Projects Farmacia

Name of the Vulnerable Software and Affected Versions: code-projects Farmacia version 1.0 Description: A vulnerability was found in the file usuario.php, where the manipulation of the name argument leads to cross-site scripting. It is possible to initiate the attack remotely. Other parameters mig...

The vulnerability in the operation_mode.cgi script of NETGEAR R7000P microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability in the operationmode.cgi script of NETGEAR R7000P router microprogramming software is related to buffer overflow during the processing of the devicename2 parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability in the wiz_dyn.cgi script of NETGEAR XR300 microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability in the wizdyn.cgi script of NETGEAR XR300 router microprogramming software relates to the failure to take measures to neutralize special elements used in operating system commands when processing the parameter systemname. Exploiting this vulnerability allows a malicious actor to...

CVE-2024-11587

A vulnerability was found in idcCMS 1.60. It has been classified as problematic. This affects the function GetCityOptionJs of the file /inc/classProvCity.php. The manipulation of the argument idName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has bee...

GoCast 操作系统命令注入漏洞

GoCast is a tool for controlling BGP route announcements from the host by individual developer mayuresh82. An OS command injection vulnerability exists in GoCast version 1.1.3, which stems from an OS command injection in the name parameter and could lead to arbitrary command execution...

PT-2024-22632 · Gocast +1 · Gocast +1

Name of the Vulnerable Software and Affected Versions: GoCast version 1.1.3 Description: An OS command injection issue exists in the name parameter of GoCast, allowing arbitrary command execution via a specially crafted HTTP request. This can be triggered by an unauthenticated HTTP request...

CVE-2024-52702

A stored cross-site scripting XSS vulnerability in the component install\index.php of MyBB v1.8.38 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Name parameter. NOTE: this is disputed by the Supplier because Website Name can only be set ...