1931 matches found
CVE-2020-15056
CVE-2020-15056 affects TP-Link TL-PS310U USB Network Server devices up to version 2.079.000.t0210. Affected function is the server name setting under administrative privileges, allowing an attacker on the same network to perform persistent cross-site scripting via a crafted server name. The vulne...
Car Rental Management System 1.0 Cross Site Scripting
Exploit Title: Car Rental Management System v1.0 - Unauthenticated Persistent XSS Session Harvester Exploit Author: Bobby Cooke Date: August 6, 2020 Vendor Homepage: https://projectworlds.in Software Link: https://github.com/projectworlds32/Car-Rental-Syatem-PHP-MYSQL/archive/master.zip Version:...
CVE-2020-15944
An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability, an attacker has to be authenticat...
Input validation
An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability, an attacker has to be authenticat...
CVE-2020-15944
An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input, it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability, an attacker has to be authenticat...
CVE-2020-13971
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...
Design/Logic Flaw
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...
CVE-2020-13971
In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication...
CVE-2020-13971
Shopware CVE-2020-13971 affects Shopware before 6.2.3. Authenticated users can use the Mediabrowser fileupload to upload SVG images containing JavaScript, causing Persistent XSS. An uploaded image can be accessed without authentication, enabling the attack to be carried out by non-privileged user...
Findus - Directory Listing < 1.1.15 - Authenticated Persistent XSS
Authenticated Persistent XSS vulnerability was discovered in the «Findus - Directory Listing WordPress Theme», tested version — v1.1.14. PoC Injected payload will trigger in the admin dashboard, in the «My listings» page and on listing page itself. POST /submit-listing/ HTTP/1.1 Host: example.com...
Findus - Directory Listing < 1.1.15 - Authenticated Persistent XSS
Authenticated Persistent XSS vulnerability was discovered in the «Findus - Directory Listing WordPress Theme», tested version — v1.1.14. Injected payload will trigger in the admin dashboard, in the «My listings» page and on listing page itself. POST /submit-listing/ HTTP/1.1 Host: example.com...
CVE-2020-15535
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields...
Design/Logic Flaw
An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields...
Design/Logic Flaw
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields...
CVE-2020-15535
The CVE-2020-15535 entry concerns the WordPress plugin bestsoftinc Car Rental System (up to version 1.3). The vulnerability is a persistent cross-site scripting (XSS) flaw that can be triggered via registration fields in the plugin’s UI, leading to stored XSS. Several connected sources corroborat...
CVE-2020-15536
The CVE-2020-15536 entry concerns the WordPress plugin bestsoftinc Hotel Booking System Pro (versions up to 1.1). Multiple connected sources confirm a persistent (stored) cross-site scripting vulnerability affecting registration/booking input fields, allowing injected script to execute in context...
CVE-2020-15536
An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields...
Careerfy < 4.1.0 - Multiple Cross-Site Scripting (XSS) Issues
An Unauthenticated Reflected & Multiple Authenticated Persistent XSS vulnerabilities was discovered in the Careerfy Job Board theme through 3.9.0 and 4.0.0 for WordPress. Authenticated Persistent XSS on the Candidate and Employer Profile pages. An Authenticated Persistent XSS @ Job Page will...