SUSE CVE-2021-26247

As an unauthenticated remote user, visit "http:///authchangepassword.php?ref=alert1" to successfully execute the JavaScript payload present in the "ref" URL parameter...

UBUNTU-CVE-2021-26247

As an unauthenticated remote user, visit "http:///authchangepassword.php?ref=alert1" to successfully execute the JavaScript payload present in the "ref" URL parameter...

Cacti 跨站脚本漏洞

Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool obtains data via snmpget, analyzes it using RRDtool drawing graphs, and provides data and user management features. Cacti suffers from a cross-site scripting vulnerability that allows an...

CVE-2021-20105

Machform prior to version 16 is vulnerable to an open redirect in Safariinit.php due to an improperly sanitized 'ref' parameter...

CVE-2021-20105

Machform prior to version 16 is vulnerable to an open redirect in Safariinit.php due to an improperly sanitized 'ref' parameter...

Machform 输入验证错误漏洞

MachForm is an HTML form builder that lets you create contact forms, surveys, order forms or any other web form without writing code. An open redirect vulnerability exists in Safariinit.php in versions prior to Machform 16. The vulnerability stems from improper validation of the ref parameter. An...

Shopizer 跨站脚本漏洞

Shopizer is a Java open source e-commerce software. A cross-site scripting vulnerability exists in Shopizer versions prior to 2.17.0. A remote attacker can exploit this vulnerability by using the ref parameter to inject arbitrary Web script or HTML into a page about any product...

Shopizer 2.16.0 - (Multiple) Cross-Site Scripting Vulnerability

Exploit Title: Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting XSS Exploit Author: Marek Toth Vendor Homepage: https://www.shopizer.com Software Link: https://github.com/shopizer-ecommerce/shopizer Version: alert1 and save it 4. Open "Customers" - XSS payload will trigger Reflected XSS - 'ref'...

CVE-2017-17737

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below has XSS via the REF parameter to /networkdiagnostics.html or /storageinfo.html...

CVE-2017-17737

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below has XSS via the REF parameter to /networkdiagnostics.html or /storageinfo.html...

CVE-2017-17737

The BrightSign Digital Signage 4k242 device Firmware 6.2.63 and below has XSS via the REF parameter to /networkdiagnostics.html or /storageinfo.html...

Sql injection

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the 1 checkdownload and possibly 2 checkfilename function in upload/admin2/model/products/modeladmindownload.php or remote authenticated users wit...

WordPress Custom Website Data Plugin <= 1.0 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability via wp-admin/admin.php ref parameter. Solution Update the plugin...

CVE-2014-4524

Cross-site scripting XSS vulnerability in classes/custom-image/media.php in the WP Easy Post Types plugin before 1.4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ref parameter...