Stored XSS in Add new question

Description Stored cross-site scripting also known as second-order or persistent XSS arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way. steps 1-log in as an admin user first. 2-go to :...

Blind Stored XSS in admin panel (open question page)

Description Blind stored XSS via any unauthorized or anonymous visitor user without any privileges can inject XSS payload in "Add question" page in "Your Name" input field then it will be executed in admin panel in Open Question page Proof of Concept...

Chained Quiz < 1.3.2.5 - Arbitrary Question Deletion via CSRF

The plugin does not have CSRF check when deleting questions, which could allow attackers to make logged in admins perform such action via a CSRF attack...

Quiz and Survey Master < 8.0.5 - Improper Input Validation

The plugin does not properly validate the questionid parameter, which could allow attackers to send values other than the expected type...

PT-2022-25351 · WordPress · Quiz/Survey Master

Name of the Vulnerable Software and Affected Versions: Quiz and Survey Master plugin for WordPress versions up to, and including, 8.0.4 Description: The issue is related to input validation bypass via the questionid parameter. Insufficient input validation allows attackers to inject content other...

CVE-2022-41431

xzs v3.8.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /admin/question/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field...

xzs 跨站脚本漏洞

Civic Jump Technology xzs Learning Zest Open Source Exam System is the Learning Zest Open Source Exam System from Civic Jump Technology. A security vulnerability exists in xzs version v3.8.0, which originated from a cross-site scripting XSS vulnerability found in the component /admin/question/edi...

CVE-2022-41431

xzs v3.8.0 was discovered to contain a cross-site scripting XSS vulnerability in the component /admin/question/edit. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field...

CVE-2022-38260

Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=questiondelete&id=...

CVE-2022-38260

Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=questiondelete&id=...

VulnCheck KEV: CVE-2021-24762

The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection...

CVE-2022-2685

A vulnerability was found in SourceCodester Interview Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /addQuestion.php. The manipulation of the argument question with the input alert1 leads to cross site scripting. The attack may be...

Directory Traversal

moodle/moodle is vulnerable to directory traversal. It does not validate the path used to import a lesson question, allowing an authorized user to cause an arbitrary file read via this feature...

Emerson DeltaV Distributed Control System 加密问题漏洞

Emerson DeltaV Distributed Control System is an automated distributed control system from Emerson. The system includes functions such as network security management, alarm management, batch control, and change management. The Emerson DeltaV Distributed Control System is vulnerable to a...

MAL-2022-5075 Malicious code in one-question-survey (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35fc754254526d2f335882bc8817a2905fe6c237026739e9068a78ea2c401484 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in one-question-survey (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35fc754254526d2f335882bc8817a2905fe6c237026739e9068a78ea2c401484 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-XH2J-Q4MC-V522 Moodle calculated question type allows remote code execution by Question authors

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...

Moodle calculated question type allows remote code execution by Question authors

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...

GHSA-P7V9-GJRH-563X Moodle XSS Vulnerability

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank...

Moodle Authentication Bypass in Question-Bank

The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a savequestion action...