6033 matches found
NPS computy < 2.7.6 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Settings NPS Monitoring" 2...
CVE-2024-25807
Cross Site Scripting XSS vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album...
CVE-2024-25807
Cross Site Scripting XSS vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album...
Lychee 安全漏洞
Lychee is a beautiful and easy to use photo management system from The Lychee Organisation open source. It is used to manage and share photos. A security vulnerability exists in Lychee version 3.1.6, which stems from a cross-site scripting XSS vulnerability. The vulnerability can be exploited by ...
GHSA-XGJ4-2HRF-J4XG Cross-site scripting in Survey Creator
Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...
CVE-2024-28635
Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...
CVE-2024-28635
Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...
Survey Creator Library 跨站脚本漏洞
Survey Creator Library is SurveyJS open source a GUI-based no-code form generator library . A cross-site scripting vulnerability exists in Survey Creator Library v.1.9.132 and earlier versions that could allow an attacker to execute arbitrary code and obtain sensitive information via the title...
Hitachi NAS SMU 14.8.7825 Information Disclosure
Exploit Title: Hitachi NAS HNAS System Management Unit SMU 14.8.7825 - Information Disclosure CVE: CVE-2023-6538 Date: 2023-12-13 Exploit Author: Arslan Masood @arszilla Vendor: https://www.hitachivantara.com/ Version: --id --sso " Create --host argument: parser.addargument "--host", required=Tru...
Information Disclosure
Liferay Portal is vulnerable to Information Disclosure. The vulnerability is due to an enumeration of user screen names, allowing remote authenticated users to obtain a user's full name from the page's title. This potentially leads to Information Disclosure...
Quick.CMS 6.7 SQL Injection
Exploit Title: Quick.CMS 6.7 SQL Injection Login Bypass Google Dork: N/A Date: 02-03-2024 Exploit Author: ./H4X.Forensics - Diyar Vendor Homepage: https://www.opensolution.org Software Link: https://opensolution.org/download/home.html?sFile=Quick.Cmsv6.7-en.zip Version: 6.7 Tested on: Windows CVE...
CVE-2024-26050 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to th...
WPB Show Core < 2.6 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
UBUNTU-CVE-2024-27756
GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title...
Mobatek MobaXterm < 21.0 (CVE-2021-28847)
The version of Mobatek MobaXterm installed on the remote host is prior to 21.0. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-28847 advisory. - MobaXterm before 21.0 allows remote servers to cause a denial of service Windows GUI hang via tab title change requests tha...
CVE-2024-27756
GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title...
CVE-2024-27756
GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title...
KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow
Exploit Title: KiTTY 0.76.1.13 - 'Start Duplicated Session Username' Buffer Overflow Exploit Author: DEFCESCO Austin A. DeFrancesco Vendor Homepage: https://github.com/cyd01/KiTTY/= Software Link: https://github.com/cyd01/KiTTY/releases/download/v0.76.1.13/kitty-bin-0.76.1.13.zip Version: ≤...
Honeywell PM43 < P10.19.050004 - Remote Code Execution (RCE)
Exploit Title: Honeywell PM43 ' if htmlstartindex != -1: return responsetext:htmlstartindex else: return responsetext except requests.exceptions.RequestException as e: return f"Error: e" def main: parser = argparse.ArgumentParserdescription='Command Injection PoC for Honeywell PM43 Printers'...