PT-2022-10220 · Easyvista · Easyvista Service Manager

Name of the Vulnerable Software and Affected Versions: EasyVista Service Manager version 2018.1.181.1 Description: The issue is related to a Cross Site Scripting XSS vulnerability in the New equipment page. This vulnerability allows remote attackers to run arbitrary code via the notes field...

CVE-2021-24807

The Support Board WordPress plugin before 3.3.5 allows Authenticated Agent+ users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed...

WordPress 插件 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. cross-site scripting vulnerability exists in the...

Support Board < 3.3.5 - Agent+ Stored Cross-Site Scripting

The plugin allows Authenticated Agent+ users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authenticated user go to the chat the XSS will be automatically executed. PoC POST /supportboard/include/ajax.php HTTP/1.1 Cookie: Agent+...

The vulnerability of the osTicket customer support system, related to the lack of mechanisms to neutralize elements in the CSV file, allows a violator to execute arbitrary code.

The vulnerability of the osTicket customer support system lies in the lack of a mechanism to eliminate certain elements in the CSV file specifically, the fields “Name” and “Internal Notes” in the “Users” tab. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

MineTime Cross-Site Scripting Vulnerability

MineTime is an intuitive and smart calendar application. A cross-site scripting vulnerability exists in MineTime 1.8.5 and earlier versions that can be exploited by an attacker to execute code via the notes field in a meeting invitation...

CVE-2020-7355

Cross-site Scripting XSS vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record o...

CVE-2018-19914

DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field...

CVE-2018-19914

DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field...

DomainMOD cross-site scripting vulnerability (CNVD-2018-26480)

DomainMod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets. A cross-site scripting vulnerability exists in the admin/domain-fields/ page in DomainMod 4.11.01 and earlier versions. A remote attacker can exploit this vulnerabilit...

CVE-2018-19751

DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields...

CVE-2018-19751

DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields...

CVE-2018-19750

DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields...

CVE-2018-19752

DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar...

CVE-2018-19751

DomainMOD 4.11.01 contains a stored cross-site scripting vulnerability in the admin/ssl-fields/add.php page (Display Name, Description & Notes fields). The root cause is input processing that allows injected JavaScript to be stored and executed in the victim’s browser, with potential for session ...

IDenticard Two-Reader Controller Configuration Manager Cross-Site Scripting Vulnerability

IDenticard Two-Reader Controller is a dual-reader controller from IDenticard Systems, Inc. Configuration Manager is one of the configuration managers. A cross-site scripting vulnerability exists in IDenticard Two-Reader Controller Configuration Manager version 1.18.8 396. A remote attacker can...

CVE-2017-14973

IDenticard Two-Reader Controller Configuration Manager 1.18.8 396 is vulnerable to Stored Cross-Site Scripting XSS via the notes field in /userhandler?file=loggedin.shtm aka the edit user page...