6032 matches found
Code injection
Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field...
Notable 安全漏洞
Notable is a Markdown-based note-taking software with cross-platform support from the individual developers of Notable. A security vulnerability exists in Notable version 1.8.4, which stems from unfiltered text editing and allows an attacker to execute arbitrary code via a crafted payload injecte...
CVE-2022-26198
Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field...
PT-2022-17717 · Notable · Notable
Name of the Vulnerable Software and Affected Versions: Notable version 1.8.4 Description: The issue allows attackers to execute arbitrary code via a crafted payload injected into the Title text field, due to a lack of filtering for text editing. Recommendations: For Notable version 1.8.4, conside...
Home Owners Collection Management System 1.0 SQL Injection Vulnerability
Exploit Title: Home Owners Collection Management System 1.0 - Remote Code Execution Blind SQLi to RCE Exploit Author: Hejap Zairy Vendor Homepage: https://www.sourcecodester.com/ Software Link:...
WordPress Download Monitor Plugin Cross-Site Scripting (CVE-2021-23174)
A stored cross-site scripting vulnerability exists in Download Monitor Plugin for WordPress. The vulnerability is due to insufficient sanitization of user-supplied data in posttitle parameter...
Microweber post title denial of service vulnerability
Microweber is a drag-and-drop online store management system from the Microweber community in the United States. A denial of service vulnerability exists in versions of Microweber prior to 1.2.12. The vulnerability stems from the fact that the application allows large characters to be inserted in...
CVE-2022-0961
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12...
CVE-2022-0961 The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12...
Microweber 输入验证错误漏洞
Microweber is a drag-and-drop online store management system from the Microweber community in the United States. A denial of service vulnerability exists in versions of Microweber prior to 1.2.12. The vulnerability stems from the fact that the application allows large characters to be inserted in...
CVE-2021-24897
The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field available only with classic editor when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...
CVE-2021-24897
The Add Subtitle WordPress plugin through 1.1.0 does not sanitise or escape the sub-title field available only with classic editor when output in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...
The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
Proof of Concept 1. Go to add post http://site.com/admin/post/create 2. click on create new post 3. There will a option called post title 4. Fill the input field with huge characters, more than 1 lakh 5. Copy the below payload and put it in the input fields and click on continue. 6. You will see...
UBUNTU-CVE-2021-32436
An out-of-bounds read in the function writetitle in subs.c of abcm2ps v8.14.11 allows remote attackers to cause a Denial of Service DoS via unspecified vectors...
WordPress Plugin Post-Duplicator Plugin 跨站脚本漏洞
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. WordPress Plugin Post-Duplicator Plugin 2.23 is vulnerable to a cross-site scripting vulnerability, which stems from an XSS payload given in t...
PT-2022-10077 · Abcm2Ps +3 · Abcm2Ps +3
Name of the Vulnerable Software and Affected Versions: abcm2ps version 8.14.11 Description: The issue is related to an out-of-bounds read in the write title function in subs.c, which allows remote attackers to cause a Denial of Service DoS via unspecified vectors. Recommendations: For abcm2ps...
CVE-2021-33852
A cross-site scripting XSS attack can cause arbitrary code JavaScript to run in a user's browser and can use an application as the vehicle for the attack. The XSS payload given in the "Duplicate Title" text box executes whenever the user opens the Settings Page of the Post Duplicator Plugin or th...
WordPress Title Experiments Free plugin <= 9.0 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Title Experiments Free plugin versions = 9.0. Solution Update the WordPress Title Experiments Free plugin to the latest available version at least 9.0.1...
Pimcore 跨站脚本漏洞
Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. cross-site scripting vulnerability exists i...
