37 matches found
CVE-2026-72507 Toptech TMS7 and TopHAT SQL Injection
The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability...
CVE-2026-72507 Toptech TMS7 and TopHAT SQL Injection
The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability...
Stored XSS vulnerability in summary_report
summaryreport 1.15 and earlier does not escape the job name in a JavaScript context in build report pages. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission. As of publication of this advisory, there is no fix...
CVE-2023-49334
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report...
The vulnerability of the Executive Summary Report component of the Nagios XI IT infrastructure monitoring tool allows a attacker to execute arbitrary code.
The vulnerability of the Executive Summary Report component of the Nagios XI IT infrastructure monitoring tool is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2024-14001
Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
EUVD-2024-55045
Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2024-14001
Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2024-14001
Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2024-14001 Nagios XI < 2024R1.1.3 XSS via Executive Summary Report
Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2024-14001
Nagios XI prior to 2024R1.1.3 is vulnerable to cross-site scripting (XSS) via the Executive Summary Report component. The root cause is insufficient validation or escaping of user-supplied input in that component, allowing an attacker to inject and execute arbitrary script in a victim’s browser. ...
CVE-2024-14001: Improper Neutralization of Input During Web Page Generation
Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting XSS via the Executive Summary Report component. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
PT-2025-44558
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.1.3 Description Nagios XI is susceptible to cross-site scripting XSS through the Executive Summary Report component. A lack of proper input validation or escaping could allow an attacker to inject and execute...
Linux Distros Unpatched Vulnerability : CVE-2023-5551
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. CVE-2023-5551 Note that Nessus...
CVE-2024-36173 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page...
CVE-2023-49334
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report...
CVE-2023-49334: Improper Neutralization of Special Elements used in an SQL Command
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report...
HackerOne: Attachment disclosure via summary report
A critical vulnerability was discovered in the HackerOne platform that allowed an attacker to gain unauthorized access to attachments belonging to other users through the report summary editing functionality. By manipulating attachment IDs in the request, an attacker could view sensitive files th...
