Cross site scripting

The application was vulnerable to an authenticated Stored Cross-Site Scripting XSS in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile...

Shortcode For Current Date < 2.1.7 - Contributor+ Stored Cross-Site Scripting

The plugin does not escape the some of its shortcode's attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks currentdate format='d/m/Y' size="10px;position:absolute;top:0;left:0;max-width:9999px;width:9999px;height:9999px'...

Cross-site Scripting (XSS) - Stored in Space Name

Description Cross-site Scripting XSS - Stored in space name. Because space name is not HTML encoded, "Confirm action" modal pops up then the script is executed. Proof of Concept Step 1: Create a new Space and fill in name with this payload: "alert1. Step 2: Send an invite to victim then save. Ste...

CVE-2022-1336 Carousel CK <= 1.1.0 - Admin+ Stored Cross-Site Scripting

The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed...

titra 跨站脚本漏洞

titra is a modern open source time tracking project for freelancers and small teams. A cross-site scripting vulnerability exists in versions prior to titra 0.77.0, which stems from DOM stored cross-site scripting XSS...

Nablarch Incomplete Cryptography

An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 5, and 5u1 to 5u13 allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors...

Team Members < 5.1.1 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC The teamcolor field ie "Main color" setting of a team is affected POST /wp-admin/post.php HTTP/1.1 Accept:...

Unrestricted file upload

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to...

YetiForceCrm 代码问题漏洞

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A security vulnerability exists in YetiForceCrm versions prior to 6.4.0, which stems from a problematic unreconstructed file upload in the application. An attacker could send a malicious file to the victim and use the...

Coru LFMember <= 1.0.2 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check in place when adding a new game, and is lacking sanitisation as well as escaping in their settings, allowing attacker to make a logged in admin add an arbitrary game with XSS payloads ' / ' / ' / " / ' /...

Social Stickers <= 2.2.9 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF checks in place when updating its Social Network settings, and does not escape some of these fields, which could allow attackers to make a logged-in admin change them and lead to Stored Cross-Site Scripting issues. history.pushState'', '', '/' input type="hidden"...

GHSA-XCR3-4QVR-54RH Cross-site Scripting in Pimcore

Pimcore prior to version 10.4 is vulnerable to stored cross-site scripting in Tooltip...

Testimonial Slider <= 3.5.8.3 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its slider settings, such as mpsppostsbgcolor, mpsppostsdescriptioncolor, mpspslidenavbuttoncolor which could allow users with the editpost capability contributor and above to perform Cross-Site Scripting attacks...

3D FlipBook < 1.12.1 - Subscriber+ Stored Cross-Site Scripting

The plugin does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook. As a subscriber:...

AZL-36996 CVE-2020-25722 affecting package samba for versions less than 4.18.3-1

Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise...

ALPINE-CVE-2020-25722

Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise...

DEBIAN-CVE-2020-25722

Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise...

PYSEC-2021-858

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends result stores. When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery...

Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting

The plugin does not sanitise and escape Template data before outputting it in various pages such as admin dashboard and frontend. Due to the lack of authorisation and CSRF checks in the wpdmsavetemplate AJAX action, any authenticated users such as subscriber is able to call it and perform...

UBUNTU-CVE-2020-25722

Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise...