idreamsoft iCMS Operating System Command Injection Vulnerability

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in iCMS 7.0.14, which can be exploited by an attacker to install.php by executing arbitrary OS commands via shell metacharacters in the DB NAME parameter...

News Script PHP Pro Cross-Site Scripting Vulnerability

News Script PHP Pro is a PHP/MySQL based web script from Simple PHP Scripts for displaying news on your website. A cross-site scripting vulnerability exists in News Script PHP Pro 2.3. The vulnerability can be exploited to conduct cross-site scripting attacks via the editorname parameter...

CVE-2020-25474

SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting XSS vulnerability via the editorname parameter...

Simplephpscripts News Script PHP Pro 跨站脚本漏洞

News Script PHP Pro is a PHP/MySQL based web script from Simple PHP Scripts for displaying news on your website. A cross-site scripting vulnerability exists in News Script PHP Pro 2.3. The vulnerability can be exploited to conduct cross-site scripting attacks via the editorname parameter...

CVE-2020-9299

There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user...

PT-2020-20574

Name of the Vulnerable Software and Affected Versions Dispatch affected versions not specified Description The Dispatch application has a security issue where an authenticated user can exploit XSS vulnerabilities. These vulnerabilities affect the name and description parameters of Incident...

CVE-2020-25272

In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in booknow.php...

CVE-2020-25272: Improper Neutralization of Input During Web Page Generation

In SourceCodester Online Bus Booking System 1.0, there is XSS through the name parameter in booknow.php...

PT-2020-16055

Name of the Vulnerable Software and Affected Versions SourceCodester Online Bus Booking System version 1.0 Description The issue concerns a problem where an attacker can inject malicious code through the name parameter in the "book now.php" endpoint. This allows for potential exploitation...

CVE-2020-25990

WebsiteBaker 2.12.2 allows SQL Injection via parameter 'displayname' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...

CVE-2020-25131

An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the rolename or roledescr parameter to the roles/ URI...

CVE-2020-13500

SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially crafted SOAP web requests can cause SQL injections resulting in data compromise. Parameter ClassName in CHaD.asmx is vulnerable to unauthenticated SQL...

CVE-2020-12817: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input vulnerability in FortiAnalyzer before 6.4.1 and 6.2.5 may allow a remote authenticated attacker to inject script related HTML tags via Name parameter of Storage Connectors...

PT-2020-6792

Name of the Vulnerable Software and Affected Versions FortiAnalyzer versions prior to 6.4.1 FortiAnalyzer versions prior to 6.2.5 Description The issue is related to the improper handling of the Name parameter in the Storage Connectors component of FortiAnalyzer, allowing a remote attacker to...

ElkarBackup Cross-Site Scripting Vulnerability

ElkarBackup is a free open source backup solution based on RSync/RSnapshot. A persistent cross-site scripting vulnerability exists in the Policies action Name parameter in ElkarBackup 1.3.3. An attacker can exploit this vulnerability to steal user session cookies...

CVE-2020-24924

A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...

CVE-2020-24924

A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...

Cross site scripting

A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...

CVE-2020-24924

A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...

CVE-2020-24924: Improper Neutralization of Input During Web Page Generation

A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies action Name Parameter...