2531 matches found
CVE-2021-31930: Improper Neutralization of Input During Web Page Generation
Persistent cross-site scripting XSS in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the...
Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilities
The theme did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues - Unauthenticated Reflected XSS | Search query, vulnerable parameters: keywordsearch and locationsearch - Authenticated Persistent XSS & XFS |...
Customer Relationship Management System 1.0 Cross Site Scripting
Exploit Title: Customer Relationship Management CRM System 1.0 - 'Category' Persistent Cross site Scripting Date: 14-05-2021 Exploit Author: Vani K G Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
CVE-2020-23263
Fork CMS 5.8.2 is affected by a persistent cross-site scripting (XSS) vulnerability (CVE-2020-23263). Attack vector: remote, via user-supplied data in navigation_title and title parameters on /private/en/pages/add. Impact described as injection of arbitrary Javascript code; authenticated/unauthen...
CVE-2020-23263: Improper Neutralization of Input During Web Page Generation
Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigationtitle" parameter and the "title" parameter in /private/en/pages/add...
Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting
Exploit Title: Savsoft Quiz 5 - 'User Account Settings' Persistent Cross-Site Scripting Date: 2021-05-04 Exploit Author: strider Software Link: https://github.com/savsofts/savsoftquizv5 Vendor: https://savsoftquiz.com Version: 5.0 Tested on: Ubuntu 20.04 LTS / Kali Linux...
CVE-2020-21987
CVE-2020-21987 affects HomeAutomation v3.3.2. The vulnerability is persistent Cross Site Scripting (XSS) caused by insufficient sanitization of input passed via multiple parameters to several scripts, allowing arbitrary HTML/script execution in a user’s browser session. Multiple connected sources...
CVE-2020-21987: Improper Neutralization of Input During Web Page Generation
HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting XSS. XSS vulnerabilities occur when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's...
WP Super Cache < 1.7.3 - Authenticated Stored Cross-Site Scripting (XSS)
The plugin did not properly sanitise its wpcachelocation parameter in its settings, which could lead to a Stored Cross-Site Scripting issue. -- Payloads: $ ";' onmouseover=alertdocument.cookie; style=position:fixed;width:100%;height:100%;margin:0;padding:0;left:0;top:0; $ ";'...
WordPress WP Login Security and History plugin <= 1.0 - Authenticated Persistent XSS & XFS vulnerabilities
Authenticated Persistent XSS & XFS vulnerabilities discovered by m0ze in WordPress WP Login Security and History plugin versions = 1.0. Solution This plugin has been closed as of April 5, 2021 and is not available for download. This closure is temporary, pending a full review...
CVE-2021-20080: Improper Neutralization of Input During Web Page Generation
Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting XSS attacks by uploading a crafted XML asset file...
CVE-2021-30146
Seafile 7.0.5 2019 allows Persistent XSS via the "share of library functionality."...
CVE-2021-30146
Seafile 7.0.5 2019 allows Persistent XSS via the "share of library functionality."...
Cross site scripting
Seafile 7.0.5 2019 allows Persistent XSS via the "share of library functionality."...
CVE-2021-30146
Seafile 7.0.5 2019 allows Persistent XSS via the "share of library functionality."...
CVE-2021-30146
Seafile 7.0.5 2019 allows Persistent XSS via the "share of library functionality."...
CVE-2021-30146
CVE-2021-30146 affects Seafile Server 7.0.5 (2019). The vulnerability is a Persistent XSS in the"share of library" feature, enabling malicious JavaScript execution. The attack path described in sources indicates an attacker with a local account can create a shared library containing injected scri...
CVE-2021-30146
Seafile 7.0.5 2019 allows Persistent XSS via the "share of library functionality."...
