PT-2022-21106

Name of the Vulnerable Software and Affected Versions 74cmsSE version 3.5.1 Description A reflective cross-site scripting XSS issue was found in 74cmsSE. The issue is related to the /company/service/increment/add/im API endpoint. This allows for potential XSS attacks. Recommendations For 74cmsSE...

PT-2022-21107

Name of the Vulnerable Software and Affected Versions 74cmsSE version 3.5.1 Description A reflective cross-site scripting XSS issue was found in 74cmsSE. The issue can be exploited via the /company/account/safety/trade API endpoint. Recommendations For version 3.5.1, as a temporary workaround,...

CVE-2022-32131: Improper Neutralization of Input During Web Page Generation

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /index/notice/show...

CVE-2022-32126: Improper Neutralization of Input During Web Page Generation

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company...

CVE-2022-32127: Improper Neutralization of Input During Web Page Generation

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/viewbebrowsed/total...

CVE-2022-32125: Improper Neutralization of Input During Web Page Generation

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /job...

CVE-2022-32124: Improper Neutralization of Input During Web Page Generation

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the component /index/jobfairol/show/...

CVE-2022-32130: Improper Neutralization of Input During Web Page Generation

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/downresume/total/nature...

CVE-2022-32128: Improper Neutralization of Input During Web Page Generation

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/service/increment/add/im...

CVE-2021-40910

There is a reflective cross-site scripting XSS vulnerability in the PHPCMS V9.6.3 management side...

Cross site scripting

There is a reflective cross-site scripting XSS vulnerability in the PHPCMS V9.6.3 management side...

CVE-2021-40910

PHPCMS V9.6.3 management side is affected by a reflective XSS vulnerability. The root cause, per the documents, is a lack of proper input filtering/escaping for parameters on the admin side. This could enable injection of malicious scripts via user-supplied input that is reflected in the web inte...

CVE-2021-40910

There is a reflective cross-site scripting XSS vulnerability in the PHPCMS V9.6.3 management side...

PT-2022-11338

Name of the Vulnerable Software and Affected Versions PHPCMS version 9.6.3 Description There is a reflective cross-site scripting XSS issue in the management side. Recommendations For PHPCMS version 9.6.3, update to a version that addresses this issue, as no specific fix is detailed in the provid...

“Downthem” DDoS-for-Hire Boss Gets 2 Years in Prison

A 33-year-old Illinois man was sentenced to two years in prison today following his conviction last year for operating services that allowed paying customers to launch powerful distributed denial-of-service DDoS attacks against hundreds of thousands of Internet users and websites. The user...

WordPress Donate Extra plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. WordPress Donate Extra plugin version 2.02 and earlier contain a cross-site scripting vulnerability that...

GoCD Cross-Site Scripting Vulnerability (CNVD-2022-77809)

ThoughtWorks GoCD is a continuous delivery server. versions 20.2.0 through 21.4.0 of ThoughtWorks GoCD contain a cross-site scripting vulnerability that stems from a vulnerability to reflected cross-site scripting via an abusive function that renders arbitrary HTML into the returned page. An...

WordPress WPC Smart Wishlist for WooCommerces plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WPC Smart Wishlist for WooCommerces plugin versions prior to 2.9.9 contain a cross-site...

Cross site scripting

In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible...

CVE-2022-23137

ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and when a user clicks the url, an XSS attack will be triggered...