124 matches found
Server-side Request Forgery (SSRF)
Overview @evershop/evershop is a The React Ecommerce platform. Built with React and Postgres. Open-source and free. Fast and customizable. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the GET /images API endpoint. An attacker can cause the server to...
EUVD-2026-0797
A Blind Server-Side Request Forgery SSRF vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP request via the "GET /images" API. The vulnerability occurs due to insufficient validation of the "src" query parameter, which permits...
EverShop 安全漏洞
EverShop is a NodeJS e-commerce platform open-sourced by EverShop. A security vulnerability exists in EverShop 2.1.0 and earlier versions, which stems from insufficient validation of the src query parameter and could lead to a server-side request forgery attack...
FeehiCMS 代码问题漏洞
FeehiCMS is a Php-based CMS website builder by Liufee personal developer. A code issue vulnerability exists in FeehiCMS 2.1.1 and prior versions, which stems from the incorrect manipulation of the parameter src in the file frontend/web/timthumb.php, which could lead to server-side request forgery...
CVE-2024-25812
MyNET up to v26.05 was discovered to contain a reflected cross-site scripting XSS vulnerability via the src parameter...
CVE-2024-27708
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter...
PT-2025-52675
Name of the Vulnerable Software and Affected Versions MyNET versions prior to 26.05 Description The software contains a reflected cross-site scripting XSS issue. The vulnerability is present in the src parameter. Recommendations Update to a version newer than 26.05...
CVE-2024-25812
MyNET up to v26.05 was discovered to contain a reflected cross-site scripting XSS vulnerability via the src parameter...
CVE-2024-27708
Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker to execute arbitrary code via the src parameter...
CVE-2025-13072
The HandL UTM Grabber / Tracker WordPress plugin, in versions prior to 2.8.1 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape a parameter (specifically identified as utm_source in some records) before outputting it back to the...
CVE-2025-61431
A reflected cross-site scripted XSS vulnerability in the /jsp/gsfrfeditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and Infinity Zucchetti v4.1 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the...
PT-2025-45036
Name of the Vulnerable Software and Affected Versions Zucchetti ZMaintenance Infinity versions prior to 4.2 Zucchetti ZMaintenance Infinity Zucchetti version 4.1 Description A reflected cross-site scripting XSS issue exists in the /jsp/gsfr feditorHTML.jsp API endpoint of the software. This allow...
CVE-2025-52179
Cross-site scripting XSS vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parameter of the /ahrw/jsp/gsfrfeditorHTML.jsp endpoint...
CVE-2025-52180
A cross-site scripting (XSS) vulnerability exists in Zucchetti Ad Hoc Infinity version 4.2 and earlier. The flaw is caused by the improper neutralization of input via the pHtmlSource parameter at the /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource endpoint. This allows remote unauthenticated attackers ...
EUVD-2025-36523
IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SRC, DST, and COMMENT parameters when creating a time constraint rule. When a user adds a time constraint rul...
CVE-2025-34314 IPFire < v2.29 Stored XSS via Time Constraint Rule URL Filter
IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SRC, DST, and COMMENT parameters when creating a time constraint rule. When a user adds a time constraint rul...
PT-2025-44173
Name of the Vulnerable Software and Affected Versions IPFire versions prior to 2.29 Core Update 198 Description The software contains a stored cross-site scripting XSS issue that allows an authenticated attacker to inject arbitrary JavaScript code. This is achieved by manipulating the SRC, DST, a...
EUVD-2005-4197
Malware in sbrugna...