CVE-2023-37613

CVE-2023-37613 describes an XSS vulnerability in Assembly Software Trialworks v11.4, where an attacker can inject a crafted payload into the asset src parameter to execute arbitrary web scripts/HTML in the victim’s browser. The connected sources consistently identify the affected product/version ...

CVE-2020-19697

Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the src parameter...

CVE-2020-19697: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the src parameter...

CVE-2020-19697

Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script in the src parameter...

CVE-2021-25074: URL Redirection to Untrusted Site

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue...

CVE-2021-39312

The True Ranker plugin = 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file...

CVE-2021-39312: Improper Limitation of a Pathname to a Restricted Directory

The True Ranker plugin = 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file...

PT-2021-22521

Name of the Vulnerable Software and Affected Versions: True Ranker plugin versions = 2.2.2 Description: The issue allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the...

PT-2018-6533

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine AD Manager Plus versions 6590 through 6613 Description: The issue allows attackers to conduct URL redirection attacks via the src parameter, potentially bypassing CSRF protection or masquerading a malicious URL as trusted...

CVE-2017-17552: Cross-Site Request Forgery (CSRF)

/LoadFrame in Zoho ManageEngine AD Manager Plus build 6590 - 6613 allows attackers to conduct URL Redirection attacks via the src parameter, resulting in a bypass of CSRF protection, or potentially masquerading a malicious URL as trusted...

CVE-2016-7782

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter...

PT-2017-9339

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the src parameter in the framework/core/models/expConfig.php file. Recommendations For Exponent CMS...

CVE-2016-7782: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter...

CVE-2017-5879: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as selectloadfile. The vulnerability...

CVE-2016-5639

Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a .. dot dot in the src parameter...

CVE-2016-5639: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a .. dot dot in the src parameter...

PT-2016-6611

Name of the Vulnerable Software and Affected Versions Crestron AirMedia AM-100 versions prior to 1.4.0.13 Description A directory traversal issue exists in the cgi-bin/login.cgi file, allowing remote attackers to read arbitrary files by including a .. dot dot in the src parameter of the affected...

Wordpress fresh-page 插件-phpThumb.php文件src参数-跨站脚本漏洞

No description provided by source...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...

CVE-2014-8690

Multiple cross-site scripting XSS vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the 1 PATHINFO, the 2 src parameter in a none action to index.php, or the 3 "First...