804 matches found
CVE-2022-22571
An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions...
Cross site scripting
An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions...
CVE-2022-22571
An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions...
CVE-2022-22571
CVE-2022-22571 affects Incapptic Connect. The vulnerability arises from incorrect output encoding, enabling a stored XSS when exploited by an authenticated high-privileged user. Affected scope is described as all current versions; exploitation requires authentication and elevated privileges, with...
Cross-site Scripting (XSS) - Stored
Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. This vulnerability can be exploited by uploading a crafted payload inside a document. Then, the vulnerability can be triggered when the user previews the document´s content. Proof ...
CVE-2022-22571: Improper Neutralization of Input During Web Page Generation
An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions...
The vulnerability of the MongoDB database management system allows attackers to compromise data integrity.
The vulnerability of the MongoDB database management system lies in the lack of mechanisms for encoding or filtering output data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the data...
The vulnerability of the XML DOM implementation lies in the lack of mechanisms for encoding or escaping output data, allowing attackers to compromise the integrity of the data.
The vulnerability of the XML DOM implementation is related to improper filtering of special characters. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...
Money Transfer Management System 跨站脚本漏洞
A cross-site scripting vulnerability exists in Money Transfer Management System version 1.0, a money transfer management system. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute...
CVE-2021-23283
Eaton Intelligent Power Protector IPP prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software...
Cross-site Scripting (XSS) - Stored in alanaktion/phproject
Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. Then, the vulnerability can be triggered when the user previews the document´s content. Proof of Concept login and navigate task Dependencies This task depends on: This task is a...
WordPress plugin 跨站脚本漏洞
WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress Learning Courses plugin in versions prior to 5.0 contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output. An...
The vulnerability of the URI module in the Ansible configuration management system arises from a lack of mechanisms for encoding or shielding output data, allowing attackers to access confidential information.
The vulnerability of the Ansible configuration system’s module module relates to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability can allow attackers to access confidential data...
CVE-2022-22529
SAP Enterprise Threat Detection ETD - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls, the UI5 framework provides automated output encoding for its...
Design/Logic Flaw
SAP Enterprise Threat Detection ETD - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls, the UI5 framework provides automated output encoding for its...
PT-2022-15498
Name of the Vulnerable Software and Affected Versions SAP Enterprise Threat Detection ETD version 2.0 Description The issue arises from insufficient encoding of user-controlled inputs, potentially leading to an unauthorized attacker exploiting an XSS vulnerability. However, the UIs in ETD utilize...
Cross-site Scripting (XSS) - Generic in projectsend/projectsend
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...
Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
Description I found file upload XSS, Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. Proof of Concept 1. login and navigate to https://gitstable.yetiforce.com/index.php?module=Users&view=PreferenceEdit&record=5 2. Layout photo Add file. 3...
Cross-site Scripting (XSS) - Stored in tsolucio/corebos
Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. This vulnerability can be exploited by uploading a crafted payload inside a document. Proof of Concept https://demo.corebos.com/index.php?module=Users&action=index&parenttab=Settin...
WordPress 跨站脚本漏洞
WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL.The WordPress Testimonial plugin has a cross-site scripting vulnerability in versions prior to 1.6.0,...