1675 matches found
CVE-2018-5757
An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality, which uses a parameter in a request to command.cgi from the Monitoring page in the web UI, unsafely puts user-alterable data directly into an OS command, leading to...
CVE-2017-18364
phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter...
CVE-2018-18940
servlet/SnoopServlet a servlet installed by default in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=XSS in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web...
CVE-2018-18940: Improper Neutralization of Input During Web Page Generation
servlet/SnoopServlet a servlet installed by default in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=XSS in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web...
CubeCart Cross-Site Scripting Vulnerability
Devellion CubeCart is a free and open source e-commerce shopping cart software from Devellion UK. The software supports selling products in an online store, adding/editing products or images etc. A cross-site scripting vulnerability exists in Devellion CubeCart version 6.2.2. A remote attacker ca...
PT-2019-10169
Name of the Vulnerable Software and Affected Versions: CubeCart version 6.2.2 Description: The issue is related to Reflected XSS, which can be exploited via a query string in the ADMIN-FILE endpoint. Recommendations: For CubeCart version 6.2.2, update to a newer version that contains a fix for th...
CVE-2018-20703: Improper Neutralization of Input During Web Page Generation
CubeCart 6.2.2 has Reflected XSS via a /ADMIN-FILE/ query string...
Cross site scripting
Cross-site scripting in eventscript.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter...
CVE-2018-14481
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...
CVE-2018-14481
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...
Design/Logic Flaw
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...
CVE-2018-14481
OSClass 3.7.4 is affected by CVE-2018-14481: it has Cross-Site Scripting (XSS) via the query string to index.php (notably in the OSClass 3.7.4 release, separate from CVE-2014-6280). Other connected sources describe multiple XSS vulnerabilities in OSClass 3.7.4, including potential reflections and...
PT-2019-9027
Name of the Vulnerable Software and Affected Versions Osclass version 3.7.4 Description The issue is related to a Cross-Site Scripting XSS vulnerability. It occurs via the query string to the "index.php" endpoint. Recommendations For Osclass version 3.7.4, update to a version that includes a fix...
CVE-2018-14481: Improper Neutralization of Input During Web Page Generation
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...
PT-2019-9543
Name of the Vulnerable Software and Affected Versions VIVOTEK Network Camera Series products with firmware 0x06x through 0x08x Description The issue concerns cross-site scripting in the event script.js file, allowing remote attackers to execute arbitrary JavaScript code via a URL query string...
CVE-2018-18005: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in eventscript.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter...
CVE-2018-20520
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...
PT-2018-15412
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...
CVE-2018-20520: Improper Neutralization of Input During Web Page Generation
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...
CVE-2018-18248
Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter, the /icingaweb2/user/list query string, the /icingaweb2/monitoring/timeline query string, or the /icingaweb2/setup query string...