Discourse-Chat 安全漏洞

Discourse-Chat is a free open source chat plugin for Discourse open source internet forum software. A security vulnerability exists in versions of Discourse-Chat prior to 0.9, which originated from a cross-site scripting XSS attack by an administrator user inserting HTML in the chat title and...

Online Market Place Site 1.0 Cross Site Scripting

Exploit Title: Online Market Place Site v1.0 - Stored Cross-Site Scripting XSS Exploit Author: Joe Pollock Date: September 03, 2022 Vendor Homepage: https://www.sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html Software Link:...

Visual Composer Website Builder < 45.0.1 - Authenticated Stored XSS via Title

The plugin does not sanitise and escape post/page Title, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks Create a post using the plugin editor and add the following payload in the Title: " The XSS will be triggered when editing the post again...

Visual Composer Website Builder < 45.0.1 - Authenticated Stored XSS via Title

The plugin does not sanitise and escape post/page Title, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks PoC Create a post using the plugin editor and add the following payload in the Title: " The XSS will be triggered when editing the post again...

Jfinal Cross-site Scripting vulnerability

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...

CVE-2022-36527

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...

CVE-2022-36527

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...

CVE-2022-36527

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...

CVE-2022-36527

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...

jfinal cms 跨站脚本漏洞

jfinal cms is a java development of powerful information consulting website , using a simple and powerful JFinal as the web framework , template engine with beetl , database with mysql , front-end bootstrap framework . A security vulnerability exists in jfinal cms version v5.1.0, which stems from...

PT-2022-23448 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: Jfinal CMS version 5.1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module. Recommendations: For Jfinal CMS version...

CVE-2022-33148

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules...

Sql injection

A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules...

CVE-2022-36722

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the title parameter at /librarian/history.php...

CVE-2022-36722

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the title parameter at /librarian/history.php...

CVE-2022-36722

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the title parameter at /librarian/history.php...

Sql injection

Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the title parameter at /librarian/history.php...

CVE-2022-36722

CVE-2022-36722 affects Library Management System v1.0, where a SQL injection can be triggered via the title parameter in /librarian/history.php. Root cause: improper handling of the title input allowing SQL manipulation, leading to potential unauthorized data access and tampering. Impact (per CVS...

Library Management System SQL注入漏洞

Library Management System is a library management system with QR code attendance and automatic library card generation by King Albaracin Personal Developer. A security vulnerability exists in Library Management System v1.0 due to a SQL injection in the title parameter of its /librarian/history.ph...

WordPress plugin MotoPress Timetable and Event Schedule 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...