9586 matches found
CVE-2021-27822: Improper Neutralization of Input During Web Page Generation
A persistent cross site scripting XSS vulnerability in the Add Categories module of Vehicle Parking Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Category field...
CVE-2021-28002: Improper Neutralization of Input During Web Page Generation
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page...
Unpatched Remote Hacking Flaw Disclosed in Fortinet's FortiWeb WAF
Details have emerged about a new unpatched security vulnerability in Fortinet's web application firewall WAF appliances that could be abused by a remote, authenticated attacker to execute malicious commands on the system. "An OS command injection vulnerability in FortiWeb's management interface...
CVE-2021-39267
Persistent cross-site scripting XSS in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution such...
Cross site scripting
Persistent cross-site scripting XSS in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the cleanfileoutput protection mechanism can be bypassed...
CVE-2021-39267
Persistent cross-site scripting XSS in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution such...
CVE-2021-39267
CVE-2021-39267 describes a persistent cross-site scripting (XSS) vulnerability in the SuiteCRM web interface. The issue allows a remote attacker to inject arbitrary JavaScript by uploading files, due to a Content-Type Filter bypass where text/html is blocked but other types capable of executing J...
CVE-2021-39268
CVE-2021-39268 : Persistent XSS in SuiteCRM web interface prior to 7.11.19. An attacker can inject arbitrary JavaScript via malicious SVG files because the clean_file_output protection can be bypassed. Impact is remote code execution of JavaScript with LOW integrity impact and no confidentiality/...
CVE-2021-39268: Improper Neutralization of Input During Web Page Generation
Persistent cross-site scripting XSS in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the cleanfileoutput protection mechanism can be bypassed...
CVE-2021-39267: Improper Neutralization of Input During Web Page Generation
Persistent cross-site scripting XSS in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution such...
CVE-2021-3619 Rapid7 Velociraptor Notebooks Authenticated Persistent XSS
Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting XSS issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to...
CVE-2021-3619
CVE-2021-3619 affects Rapid7 Velociraptor up to version 0.5.9. It is a post-authentication persistent XSS vulnerability where an authenticated user could abuse MIME type sniffing to embed executable code via a malicious upload. The issue was fixed in version 0.6.0. Note that Velociraptor login ri...
MAC1100 PLC Denial of Service Vulnerability
The MAC1100 PLC is an industrial control product PLC. A security vulnerability exists in the MAC1100 PLC that can be exploited by an attacker to cause a persistent denial of service DOS via a crafted package...
CVE-2021-38757
Persistent cross-site scripting XSS in Hospital Management System targeted towards web admin through contact.php...
CVE-2021-38757
CVE-2021-38757 is a reported persistent cross-site scripting (XSS) vulnerability in a Hospital Management System (often referenced as PHPGurukul/Hospital Management System). The public descriptions consistently state that the XSS is targeted at the web admin via the contact.php endpoint. Exploit ...
CVE-2021-38756
CVE-2021-38756: Persistent cross-site scripting in Hospital Management System (PHPGurukul) via prescribe.php affecting web admin. Descriptions indicate the vulnerability enables execution of JavaScript through input on prescribe.php; root cause not explicitly stated in provided documents. CVSS sc...
CVE-2021-38757: Improper Neutralization of Input During Web Page Generation
Persistent cross-site scripting XSS in Hospital Management System targeted towards web admin through contact.php...
CVE-2021-38756: Improper Neutralization of Input During Web Page Generation
Persistent cross-site scripting XSS in Hospital Management System targeted towards web admin through prescribe.php...
PT-2021-22286
Name of the Vulnerable Software and Affected Versions Hospital Management System affected versions not specified Description The issue is related to a persistent cross-site scripting XSS in the Hospital Management System, specifically targeting web admin through the contact.php file. This allows...