1897 matches found
CVE-2020-13971
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...
Findus - Directory Listing < 1.1.15 - Authenticated Persistent XSS
Authenticated Persistent XSS vulnerability was discovered in the «Findus - Directory Listing WordPress Theme», tested version — v1.1.14. Injected payload will trigger in the admin dashboard, in the «My listings» page and on listing page itself. POST /submit-listing/ HTTP/1.1 Host: example.com...
Findus - Directory Listing < 1.1.15 - Authenticated Persistent XSS
Authenticated Persistent XSS vulnerability was discovered in the «Findus - Directory Listing WordPress Theme», tested version — v1.1.14. PoC Injected payload will trigger in the admin dashboard, in the «My listings» page and on listing page itself. POST /submit-listing/ HTTP/1.1 Host: example.com...
CVE-2020-15535
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields...
Design/Logic Flaw
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields...
Design/Logic Flaw
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields...
CVE-2020-15535
The CVE-2020-15535 entry concerns the WordPress plugin bestsoftinc Car Rental System (up to version 1.3). The vulnerability is a persistent cross-site scripting (XSS) flaw that can be triggered via registration fields in the plugin’s UI, leading to stored XSS. Several connected sources corroborat...
CVE-2020-15536
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields...
CVE-2020-15536
The CVE-2020-15536 entry concerns the WordPress plugin bestsoftinc Hotel Booking System Pro (versions up to 1.1). Multiple connected sources confirm a persistent (stored) cross-site scripting vulnerability affecting registration/booking input fields, allowing injected script to execute in context...
Careerfy < 4.1.0 - Multiple Cross-Site Scripting (XSS) Issues
An Unauthenticated Reflected & Multiple Authenticated Persistent XSS vulnerabilities was discovered in the Careerfy Job Board theme through 3.9.0 and 4.0.0 for WordPress. Authenticated Persistent XSS on the Candidate and Employer Profile pages. An Authenticated Persistent XSS @ Job Page will...
CVE-2020-13427
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...
CVE-2020-13427
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...
CVE-2020-13427
Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...
CVE-2020-13427
CVE-2020-13427 affects Victor CMS 1.0. The vulnerability is a persistent cross-site scripting (XSS) flaw exploitable via the admin/users.php?source=add_user parameters (user_name, user_firstname, user_lastname). The available connected documents confirm the existence and location of the XSS, but ...
CVE-2020-13853
Artica Pandora FMS 7.44 has persistent XSS in the Messages feature...
CVE-2020-13853
Artica Pandora FMS 7.44 has persistent XSS in the Messages feature...
CVE-2020-13853
Pandora FMS 7.44 is affected by CVE-2020-13853, a persistent Cross-Site Scripting (XSS) vulnerability in the Messages feature. The CoreLabs advisory details that an attacker can inject arbitrary JavaScript into messages, which is executed in the recipient’s browser and can facilitate session cook...
osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting
Exploit Title: osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting Date: 2020-06-26 Exploit Author: Matthew Aberegg Vendor Homepage: https://osticket.com Patch Link: https://github.com/osTicket/osTicket/commit/d54cca0b265128f119b6c398575175cb10cf1754 Version: osTicket 1.14.1 Tested o...