HackerOne: Unauthorized Ticket can be created by an Attacker in user's Helpdesk account

An unauthorized user was able to create tickets in any user's helpdesk account without authorization or knowledge...

CVE-2023-3794

A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected is an unknown function of the file /chaincity/user/ticket/create of the component New Ticket Handler. The manipulation of the argument subject leads to cross site...

CVE-2023-3794 Bug Finder ChainCity Real Estate Investment Platform New Ticket create cross site scripting

A vulnerability classified as problematic has been found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected is an unknown function of the file /chaincity/user/ticket/create of the component New Ticket Handler. The manipulation of the argument subject leads to cross site...

PT-2023-26189 · Unknown · Bug Finder Chaincity Real Estate Investment Platform

Name of the Vulnerable Software and Affected Versions: Bug Finder ChainCity Real Estate Investment Platform version 1.0 Description: A problematic vulnerability has been found in the New Ticket Handler component of the Bug Finder ChainCity Real Estate Investment Platform. The issue affects an...

Bug Finder ChainCity Real Estate Investment Platform 跨站脚本漏洞

Bug Finder ChainCity Real Estate Investment Platform is a real estate investment platform from Bug Finder, Inc. A cross-site scripting vulnerability exists in version 1.0 of the ChainCity Real Estate Investment Platform, which stems from the cross-site scripting caused by the parameter subject in...

Plane sailing for ticket scammers: How to keep your flight plans safe

You may be getting ready to jump on a plane and head off for a few days or weeks of rest and relaxation. So the last thing you need before flying is a technology related horror show. Sadly, scammers are aware of families getting ready to hit the skies, and have tailored their threats accordingly...

WordPress Plugin Event Manager and Tickets Selling Plugin for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Event Manager and Tickets...

WordPress WordPress HelpDesk & Support Ticket System Plugin – Octrace Support Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software WordPress HelpDesk & Support Ticket System Plugin – Octrace Support Type Plugin Vulnerable versions = 1.2.4 Fixed in 1.2.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

Wedding Wonders 1.0 Cross Site Scripting

Exploit Title: Wedding Wonders 1.0 - Stored XSS Exploit Author: CraCkEr Date: 13/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/wedding-wonders-a-matrimonial-and-matchmaking-platform/17 Tested on: Windows 10 Pro Impact: Manipulate t...

EX-RATE 1.0 Cross Site Scripting

Exploit Title: EX-RATE 1.0 - Stored XSS Exploit Author: CraCkEr Date: 14/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/ex-rate-a-complete-money-exchange-solution/14 Tested on: Windows 10 Pro Impact: Manipulate the content of the si...

Finounce 1.0 Cross Site Scripting

Exploit Title: Finounce 1.0 - Stored XSS Exploit Author: CraCkEr Date: 12/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/finounce-an-advance-peer-to-peer-crypto-exchange-platform/20 Tested on: Windows 10 Pro Impact: Manipulate the...

Montage 1.0 Cross Site Scripting

Exploit Title: Montage 1.0 Hotel Booking & Property Selling - Stored XSS Exploit Author: CraCkEr Date: 13/07/2023 Vendor: Bug Finder Vendor Homepage: https://bugfinder.net/ Software Link: https://bugfinder.net/product/montage-a-complete-solution-for-hotel-booking-property-selling/16 Tested on:...

HackerOne: HackerOne Support System Doesn't Require Any Authentication May Lead Unauthorized Action

The HackerOne support system did not require any authentication, allowing anyone to open a support ticket for another user's account. This could potentially lead to unauthorized actions being taken on the account...

ticket.no Cross Site Scripting vulnerability OBB-3505423

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-3560

A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functionality of the file /load.php. The manipulation of the argument firstname/secondname/phone/address1/country leads to cross site scripting. The...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functionality of the file /load.php. The manipulation of the argument firstname/secondname/phone/address1/country leads to cross site scripting. The...

GZ Scripts Ticket Booking Script 跨站脚本漏洞

GZ Scripts Ticket Booking Script is a ticket booking system from GZ Scripts. A cross-site scripting vulnerability exists in GZ Scripts Ticket Booking Script version 1.8, which stems from cross-site scripting due to incorrect manipulation of the parameters firstname, secondname, phone, address1, a...

CVE-2023-3560 GZ Scripts Ticket Booking Script load.php cross site scripting

A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is some unknown functionality of the file /load.php. The manipulation of the argument firstname/secondname/phone/address1/country leads to cross site scripting. The...

CVE-2023-3560

CVE-2023-3560 relates to a cross-site scripting vulnerability in GZ Scripts Ticket Booking Script 1.8, specifically affecting the /load.php functionality. The root cause is improper handling of input parameters (first_name/second_name/phone/address_1/country), enabling remote attacker-controlled ...

PT-2023-25230 · Unknown · Gz Scripts Ticket Booking Script

Name of the Vulnerable Software and Affected Versions: GZ Scripts Ticket Booking Script version 1.8 Description: A problematic issue has been found in the software, affecting some unknown functionality of the file /load.php. The manipulation of the arguments first name, second name, phone, addres...