PT-2021-11833 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "BrowseAssets.do" file using the title parameter. This affects products that...

PT-2021-11839 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "BrowseDirs.do" file using the title parameter. This affects products that a...

Quest Software Policy Authority For Unified Communications Cross-Site Scripting Vulnerability

Quest Software Policy Authority For Unified Communications is a software from Quest Software, Inc. that is used in enterprise environments to consolidate communication data between various media text and instant messaging, video conferencing, email and voicemail. A cross-site scripting...

sar2html 3.2.1 - 'plot' Remote Code Execution

Exploit Title: sar2html 3.2.1 - 'plot' Remote Code Execution Date: 27-12-2020 Exploit Author: Musyoka Ian Vendor Homepage:https://github.com/cemtan/sar2html Software Link: https://sourceforge.net/projects/sar2html/ Version: 3.2.1 Tested on: Ubuntu 18.04.1 !/usr/bin/env python3 import requests...

Daybyday cross-site scripting vulnerability (CNVD-2020-75072)

Daybyday is a customer relationship management system. A stored cross-site scripting vulnerability exists in Daybyday 2.1.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the Title parameter of the New Lead screen...

CVE-2020-35349

Savsoft Quiz 5 is affected by: Cross Site Scripting XSS via fieldtitle aka a title on the custom fields page...

CVE-2020-35349

Savsoft Quiz 5 is affected by: Cross Site Scripting XSS via fieldtitle aka a title on the custom fields page...

CVE-2020-35706

Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen...

CVE-2020-35704

Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen...

Cross site scripting

Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen...

Cross site scripting

Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen...

CVE-2020-35704

CVE-2020-35704 affects Daybyday version 2.1.0. The vulnerability is a stored cross-site scripting (XSS) flaw in the Title parameter of the New Lead screen, allowing an attacker-supplied payload to be stored and subsequently rendered to users. Primary impact is client-side data integrity and poten...

CVE-2020-35704

Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen...

Savsoft Quiz Cross-Site Scripting Vulnerability

Savsoft Quiz is a Php-based administration platform for creating online exams and tests by Savsoft Individual Developers. A cross-site scripting vulnerability exists in versions prior to Savsoft Quiz 5, which originates in the fieldtitle field...

Bottelet Daybyday Crm 跨站脚本漏洞

Daybyday is a customer relationship management system. A stored cross-site scripting vulnerability exists in Daybyday 2.1.0. The vulnerability can be exploited to conduct cross-site scripting attacks via the Title parameter of the New Lead screen...

Envira Gallery Lite < 1.8.3.3 - Authenticated Stored Cross-Site Scripting

The plugin does not properly sanitise the images metadata namely title before outputting them in the generated gallery. This allows privileged accounts such as editor+ to perform XSS attacks even without the unfilteredhtml capability against users visiting the gallery in the frontend. As an...

SyncBreeze 10.0.28 - 'login' Denial of Service (Poc)

Exploit Title: SyncBreeze 10.0.28 - 'login' Denial of Service Poc Data: 18-Dec-2020 Exploit Author: Ahmed Elkhressy Vendor Homepage: http://www.syncbreeze.com Software Link: http://www.syncbreeze.com/setups/syncbreezeentsetupv10.0.28.exe Version: 10.0.28 Tested on: Windows 7, Windows 10...

Magic Home Pro 1.5.1 Authentication Bypass

Exploit Title: Magic Home Pro 1.5.1 - Authentication Bypass Google Dork: NA Date: 22 October 2020 Exploit Author: Victor Hanna Trustwave SpiderLabs Author Github Page: https://9lyph.github.io/CVE-2020-27199/ Vendor Homepage: http://www.zengge.com/appkzd Software Link:...

Ornose15 NewPK SQL Injection Vulnerability

Ornose15 Newpk is a Php-based blog management platform from the individual developers at Ornose15. NewPK 1.1 version exists SQL injection vulnerability, the vulnerability stems from the title parameter adminnewpost.php does not do effective filtering of user input, attackers can use this...

Moodle Cross-Site Scripting Vulnerability (CNVD-2021-28738)

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that could allow JavaScript to be included in the title of a book chapter without being...