25 matches found
CVE-2020-7236
UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cw2?td= Site Name field of the Site Setup section...
EUVD-2020-28364
Malware in sbrugna...
EUVD-2023-44356
Malicious code in bioql PyPI...
CVE-2024-8851
The CVE pertains to the WordPress plugin Polls CP, affected versions prior to 1.0.77. The root cause is insufficient sanitisation and escaping of poll settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (notably in multi-s...
CVE-2025-3502 WP Maps < 4.7.2 - Admin+ Stored XSS
The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Cross site scripting
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...
You do not have permission to create/update the database “” on Server “” during CVAD site setup
Studio UI Error You do not have permission to create/update the database “DATABASE” on server “SQLSERVER\InstanceName, Port”. Provide credentials for an account with that permission during site setup for Always-On SQL Server Windows Event ID 36884 The certificate received from the remote server...
CVE-2023-37124
A stored cross-site scripting XSS vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2023-37124
A stored cross-site scripting XSS vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2023-37124
A stored cross-site scripting XSS vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2023-37124
CVE-2023-37124 is a stored XSS vulnerability in SEACMS v12.1, specifically in the Site Setup module. The issue allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. Affected component: Site Setup module of SEACMS v12.1. Root cause and impact: stored XSS with potential...
CVE-2023-37124
A stored cross-site scripting XSS vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2023-37124
A stored cross-site scripting XSS vulnerability in the Site Setup module of SEACMS v12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
PT-2023-25790 · Seacms · Seacms
Name of the Vulnerable Software and Affected Versions: SEACMS version 12.1 Description: A stored cross-site scripting XSS issue in the Site Setup module allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For SEACMS version 12.1, update the Site Setup...
URL Shortify < 1.7.0 - Admin+ Cross Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Navigate to "URL Shortify Settings Links"...
GetYourGuide Ticketing < 1.0.4 - Admin+ Stored XSS
The plugin does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Navigate toward the GYG Ticketing and GYG...
Google XML Sitemaps < 4.1.3 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in the "Try ...
Plone CMS 5.2.3 - 'Title' Stored XSS
Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS Date: 18-03-2021 Exploit Author: Piyush Patil Vendor Homepage: https://plone.com/ Software Link: https://github.com/plone/Products.CMFPlone/tags Version: 5.2.3 Tested on: Windows 10 Reference -...
Plone CMS 5.2.3 Cross Site Scripting
Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS Date: 18-03-2021 Exploit Author: Piyush Patil Vendor Homepage: https://plone.com/ Software Link: https://github.com/plone/Products.CMFPlone/tags Version: 5.2.3 Tested on: Windows 10 Reference -...
Dell Wyse ThinOS 授权问题漏洞
Wyse ThinOS is a specialized operating system for Dell servers from Dell USA. A security vulnerability exists in Wyse ThinOS 8.6 and prior versions, which can be exploited by an attacker to access writable files and manipulate the configuration of any targeted specific site...