1217 matches found
TP-LINK Archer C20 安全漏洞
TP-LINK Archer C20 is a router from China P&L TP-LINK. A security vulnerability exists in TP-LINK Archer C20 version V6.6230412 and prior versions. An attacker exploiting this vulnerability could add Referer: http://tplinkwifi.net to a request to be recognized as authenticated...
PT-2025-6736
Name of the Vulnerable Software and Affected Versions TP-Link Archer c20 versions prior to V6.6 230412 Description An authentication bypass exists in the firmware of the router. A remote attacker can bypass security restrictions for certain interfaces located in the /cgi directory by adding the...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Referer HTTP header due to improper sanitization. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website...
CVE-2024-56517 LGSL has a reflected XSS at /lgsl_files/lgsl_list.php
LGSL Live Game Server List provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cross-site scripting vulnerability in the Referer HTTP header. The vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the...
CVE-2024-56517
LGSL Live Game Server List provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cross-site scripting vulnerability in the "Referer" HTTP header. The vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the...
CVE-2024-56517: Improper Neutralization of Input During Web Page Generation
LGSL Live Game Server List provides online status lists for online video games. Versions up to and including 6.2.1 contain a reflected cross-site scripting vulnerability in the Referer HTTP header. The vulnerability allows attackers to inject arbitrary JavaScript code, which is reflected in the...
PT-2024-36827 · Lgsl · Lgsl
Name of the Vulnerable Software and Affected Versions: LGSL Live Game Server List versions up to and including 6.2.1 Description: The issue is related to a reflected cross-site scripting vulnerability in the Referer HTTP header. This vulnerability allows attackers to inject arbitrary JavaScript...
pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API
Summary The folder /.pyload/scripts has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved. A file can be downloaded to such...
WordPress Ninja Forms Contact Form plugin <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer vulnerability
Reflected Self-Based Cross-Site Scripting via Referer vulnerability discovered by wesley wcraft in WordPress Plugin Ninja Forms versions = 3.8.15...
CVE-2024-3866
The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2024-3866: Improper Neutralization of Input During Web Page Generation
The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
PT-2024-28105 · WordPress · Ninja Forms Contact Form
Name of the Vulnerable Software and Affected Versions: Ninja Forms Contact Form plugin for WordPress versions up to, and including, 3.8.15 Description: The issue is related to Reflected Self-Based Cross-Site Scripting via the 'Referer' header due to insufficient input sanitization and output...
PT-2024-20861 · Unknown · 3Dsecure 2.0
Name of the Vulnerable Software and Affected Versions: 3DSecure 2.0 version 3DS Authorization Method Description: A Cross-Site Request Forgery CSRF issue was identified in the Authorization Method of 3DSecure 2.0, allowing for potential exploitation via modified Origin and Referer HTTP headers...
CVE-2024-44818
Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via the HTTPReferer header of the caina.php component...
PT-2024-31265 · Zzcms · Zzcms
Name of the Vulnerable Software and Affected Versions: ZZCMS versions 2023 and earlier Description: The issue allows a remote attacker to obtain sensitive information via the HTTP Referer header of the caina.php component. This is a Cross Site Scripting vulnerability, which enables the attacker t...
CVE-2024-43009
A reflected cross-site scripting XSS vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTPREFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user...
ZZCMS 安全漏洞
ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v2023 and earlier versions, which stems from incorrect HTTPREFERER header handling, and can be exploited by an attacker to execute malicious scripts via specially crafted URLs...
PT-2024-30253 · Zzcms · Zzcms
Name of the Vulnerable Software and Affected Versions: ZZCMS versions 2023 and earlier Description: A reflected cross-site scripting XSS issue exists due to the direct insertion of the HTTP REFERER header value into the HTML response without proper sanitization in the user/login.php file at line...
Cross-site Scripting (XSS)
Roundup is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper handling of the HTTP Referer header, allowing a SCRIPT element to be executed...
