8210 matches found
CVE-2023-48881
A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...
CVE-2023-48881
A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...
PT-2023-30996 · Eyoucms · Eyoucms
Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.6.4-UTF8-SP1 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at "/login.php?m=admin&c=Field&a=arctype...
CVE-2023-48881: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...
Malicious code in one-host-page-title-management (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc83e2b70cb22321c16a33d9cc90936f0f9275da7342c5abeb2484717beea336 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in one-host-page-title-management
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CVE-2023-48078
SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter...
CVE-2023-48078
SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter...
Liferay Portal Security Vulnerability
Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, and more. A security vulnerability exists in Liferay Portal...
PT-2023-30614 · Liferay · Liferay Portal
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.94 through 7.4.3.95 Description: A reflected cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via the p l back url title parameter on a content page's edit page...
Simple CRUD Functionality Security Vulnerability
Simple CRUD Functionality is a web application. A security vulnerability exists in code-projects Simple CRUD Functionality v1.0, which stems from an SQL injection vulnerability that allows attackers to run arbitrary SQL commands via the title parameter...
PT-2023-30691 · Unknown · Simple Crud Functionality
Name of the Vulnerable Software and Affected Versions: Simple CRUD Functionality version 1.0 Description: The issue allows attackers to run arbitrary SQL commands via the title parameter in the "add.php" file. This can lead to unauthorized access and manipulation of database content...
CVE-2023-48078: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter...
SuiteCRM code injection vulnerability
SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from an HTML injection vulnerability that stems from a lack of valid filtering and escaping of user-supplied data in the salesagility/suitecrm tittle, which can be exploited by an attacker to cause HTML...
IPython set_term_title() Command Execution
The vulnerability of the settermtitle function in the IPython/ipython/utils/terminal.py command interface exists due to the lack of measures to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability could allow a malicious individual to execute...
GHSA-RMXW-C48H-2VF5 XWiki Platform privilege escalation from script right to programming right through title displayer
Impact In XWiki Platform, it's possible for a user to write a script in which any velocity content is executed with the right of any other document content author. To reproduce: As a user with script but not programming right, create a document with the following content: velocity set$main =...
CVE-2023-5532
The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the 'imgmapsaveareatitle' function. This makes it possible for unauthenticated attackers to update the post title and...
Cross site request forgery (csrf)
The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect nonce validation on the 'imgmapsaveareatitle' function. This makes it possible for unauthenticated attackers to update the post title and...
PT-2023-32158
Name of the Vulnerable Software and Affected Versions ImageMapper plugin for WordPress versions up to, and including, 1.2.6 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the imgmap save area title function. This allows unauthenticat...
CVE-2023-5910
A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component Web Config. The manipulation of the argument Site Title with the input alert1 leads to cross site scripting. The attack may be initiated...